PT-2020-1644 · Cisco+1 · Cisco Data Center Network Manager+1

Published 2020-01-02 · Updated 2020-10-22 · CVE-2019-15999

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager (DCNM) (affected versions not specified)

Description The issue is related to an incorrect configuration of authentication settings on the JBoss Enterprise Application Platform (JBoss EAP) within the Cisco Data Center Network Manager (DCNM) application environment. This could allow an authenticated, remote attacker to gain unauthorized access to the JBoss EAP by exploiting the vulnerability using a specific low-privilege account. A successful exploit could result in the attacker gaining unauthorized access to the JBoss EAP, which should be limited to internal system accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2020-00873

CVE-2019-15999

Affected Products

Cisco Data Center Network Manager

Red Hat Jboss Enterprise Application Platform

References · 6

• 🔥 https://exploit-db.com/exploits/47885 · Exploit
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-unauth-access · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15999 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15999 · Security Note
• https://bdu.fstec.ru/vul/2020-00873 · Security Note
• http://packetstormsecurity.com/files/155870/Cisco-DCNM-JBoss-10.4-Credential-Leakage.html · Note