PT-2019-3084 · Cisco · Cisco Enterprise Nfv Infrastructure

Published 2019-08-07 · Updated 2021-10-29 · CVE-2019-1953

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software (NFVIS) (affected versions not specified)

Description A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when logging in to the web portal for the first time. Subsequent password changes are not logged and other accounts are not affected. An attacker could exploit this vulnerability by viewing the admin clear text password and using it to access the affected system. The attacker would need a valid user account to exploit this vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2019-03066

CVE-2019-1953

Affected Products

Cisco Enterprise Nfv Infrastructure

References · 5

• https://bdu.fstec.ru/vul/2019-03066 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-pwrecov · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1953 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1953 · Security Note
• https://t.me/cvenotify/22669 · Telegram Post