PT-2017-3726 · Cisco · Cisco Prime File Upload Servlet+2

Published 2017-07-13 · Updated 2019-10-09 · CVE-2018-0258

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco Prime Data Center Network Manager versions 10.0 and later Cisco Prime Infrastructure all versions

Description: A vulnerability in the Cisco Prime File Upload servlet could allow a remote attacker to upload arbitrary files to any directory of a vulnerable device and execute those files due to path traversal issues and lack of restrictions on uploading dangerous file types.

Recommendations: For Cisco Prime Data Center Network Manager versions 10.0 and later, update to a version that includes the fix for the identified bug IDs. For Cisco Prime Infrastructure all versions, update to a version that includes the fix for the identified bug IDs. As a temporary workaround, consider restricting access to the file upload functionality until a patch is available.

Fix

Unrestricted File Upload

Path traversal

Weakness Enumeration

CWE-434

CWE-22

Related Identifiers

BDU:2018-01583

CVE-2018-0258

Affected Products

Cisco Prime Data Center Network Manager

Cisco Prime File Upload Servlet

Cisco Prime Infrastructure

References · 6

• https://bdu.fstec.ru/vul/2018-01583 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-0258 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0258 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-prime-upload · Vendor Advisory
• https://tenable.com/security/research/tra-2018-11 · Note
• http://securityfocus.com/bid/104074 · Note