PT-2019-2651 · Cisco · Cisco Application Policy Infrastructure Controller

Published 2019-07-03 · Updated 2020-10-16 · CVE-2019-1889

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller (APIC) Software versions (affected versions not specified)

Description The issue is related to the implementation of the REST API in the Cisco Application Policy Infrastructure Controller, specifically with inadequate access restrictions to certain features. This could allow a remote attacker to escalate their privileges to the root level by uploading malicious software. The vulnerability is due to incomplete validation and error checking for the file path when specific software is uploaded.

Recommendations For all affected versions, consider restricting access to the REST API to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the REST API for software uploads until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

CWE-264

Related Identifiers

BDU:2019-02537

CVE-2019-1889

Affected Products

Cisco Application Policy Infrastructure Controller

References · 6

• https://bdu.fstec.ru/vul/2019-02537 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-ccapic-restapi · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1889 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1889 · Vendor Advisory
• https://t.me/cvenotify/204 · Telegram Post
• https://tools.cisco.com/security/center/publicationListing.x · Note