PT-2019-2068 · Cisco · Cisco Application Policy Infrastructure Controller (Apic)

Published 2019-05-01 · Updated 2020-10-07 · CVE-2019-1692

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller (APIC) Software (affected versions not specified)

Description A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated, remote attacker to access sensitive system usage information. The issue is due to a lack of proper data protection mechanisms for certain components in the underlying Application Centric Infrastructure (ACI). An attacker could exploit this by attempting to observe certain network traffic when accessing the APIC, potentially allowing them to access and collect certain tracking data and usage statistics on an affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Information Disclosure

Weakness Enumeration

CWE-311

CWE-200

Related Identifiers

BDU:2019-01813

CVE-2019-1692

Affected Products

Cisco Application Policy Infrastructure Controller (Apic)

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-1692 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-apic-info-disc · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01813 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1692 · Vendor Advisory
• http://securityfocus.com/bid/108155 · Note
• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&sort=-day_sir&offset=20#~Vulnerabilities · Note
• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&sort=-day_sir&offset=20#~Vulnerabilities · Note