PT-2019-2412 · Cisco · Cisco Evolved Programmable Network (Epn) Manager+1

Published 2019-05-15 · Updated 2023-03-24 · CVE-2019-1819

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure versions (affected versions not specified) Cisco Evolved Programmable Network (EPN) Manager versions (affected versions not specified)

Description The issue is related to errors in processing HTTP requests in the web-based management interface. It could allow a remote attacker to gain access to restricted information by sending a specially crafted HTTP request. The vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames, allowing an attacker to use directory traversal techniques to access restricted files.

Recommendations For Cisco Prime Infrastructure, consider restricting access to the web-based management interface until a fix is available. For Cisco Evolved Programmable Network (EPN) Manager, avoid using user-supplied input in HTTP request parameters that describe filenames until the issue is resolved. As a temporary workaround, consider disabling directory traversal techniques in the web-based management interface of both products until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2019-02190

CVE-2019-1819

MGASA-2020-0123

Affected Products

Cisco Evolved Programmable Network (Epn) Manager

Cisco Prime Infrastructure

References · 15

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-pathtrav-1819 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1819 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1819 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02190 · Security Note
• https://osv.dev/vulnerability/MGASA-2020-0123 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0123.html · Security Note
• https://unicode-org.atlassian.net/browse/ICU-20958 · Note
• https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_24.html · Note
• http://securityfocus.com/bid/108351 · Note
• https://securityfocus.com/bid/108351 · Note
• https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_18.html · Note
• https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_13.html · Note
• https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html · Note
• https://bugs.mageia.org/show_bug.cgi?id=26269 · Note
• https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_11.html · Note