PT-2019-2363 · Cisco · Cisco Unified Intelligence Center

Published 2019-05-15 · Updated 2019-05-17 · CVE-2019-1860

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:N/AC:H/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Intelligence Center (affected versions not specified)

Description The issue is related to incorrect resource identifier control in the monitoring panel of Cisco Unified Intelligence Center. It could allow a remote attacker to impact the confidentiality and integrity of protected information using a specially crafted gadget. The vulnerability is due to the lack of gadget validation, which could be exploited by forcing a user to load a malicious gadget, potentially allowing the attacker to obtain sensitive information, such as current user credentials, or manipulate data between the user's browser and Cisco Unified Intelligence Center.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-99

Related Identifiers

BDU:2019-02138

CVE-2019-1860

Affected Products

Cisco Unified Intelligence Center

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-1860 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-cuic-cmdinj · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02138 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1860 · Vendor Advisory
• http://securityfocus.com/bid/108354 · Note