PT-2019-3938 · Cisco · Cisco Wireless Lan Controller+1

Fabian Beck + 2 · Published 2019-10-16 · Updated 2019-10-22 · CVE-2019-15266

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controller (WLC) Software (affected versions not specified)

Description A vulnerability in the CLI of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, local attacker to view system files that should be restricted. This issue is due to improper sanitization of user-supplied input in command-line parameters that describe filenames. An attacker could exploit this by using directory traversal techniques to submit a path to a desired file location, potentially allowing them to view system files containing sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2019-04418

CVE-2019-15266

Affected Products

Cisco Wireless Lan Controller

Cisco Wls

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-wlc-pathtrav · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15266 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04418 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-15266 · Security Note