Sign-up

ID

VAR-201904-0423


CVE

CVE-2019-1797


TITLE

Cisco Wireless LAN Controller Software cross-site request forgery vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-003529

DESCRIPTION

A vulnerability in the web-based management interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on the device with the privileges of the user, including modifying the device configuration. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an interface user to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the device with the privileges of the user. Software versions prior to 8.3.150.0, 8.5.135.0, and 8.8.100.0 are affected. Other attacks are also possible. This issue is being tracked by Cisco Bug ID CSCvj06910

Trust: 1.98

sources: NVD: CVE-2019-1797 // JVNDB: JVNDB-2019-003529 // BID: 107998 // VULHUB: VHN-150269

AFFECTED PRODUCTS

vendor:ciscomodel:wireless lan controller softwarescope:ltversion:8.3.150.0

Trust: 1.8

vendor:ciscomodel:wireless lan controller softwarescope:ltversion:8.8.100.0

Trust: 1.8

vendor:ciscomodel:wireless lan controller softwarescope:gteversion:8.7.106.0

Trust: 1.0

vendor:ciscomodel:wireless lan controller softwarescope:ltversion:8.5.150.0

Trust: 1.0

vendor:ciscomodel:wireless lan controller softwarescope:gteversion:8.5.131.0

Trust: 1.0

vendor:ciscomodel:wireless lan controller softwarescope:ltversion:8.5.135.0

Trust: 0.8

vendor:ciscomodel:wireless lan controller softwarescope:eqversion:8.8

Trust: 0.3

vendor:ciscomodel:wireless lan controller softwarescope:eqversion:8.7

Trust: 0.3

vendor:ciscomodel:wireless lan controller softwarescope:eqversion:8.6

Trust: 0.3

vendor:ciscomodel:wireless lan controller softwarescope:eqversion:8.5

Trust: 0.3

vendor:ciscomodel:wireless lan controller softwarescope:eqversion:8.4

Trust: 0.3

vendor:ciscomodel:wireless lan controller softwarescope:eqversion:8.3

Trust: 0.3

vendor:ciscomodel:wireless lan controller softwarescope:eqversion:8.2

Trust: 0.3

vendor:ciscomodel:wireless lan controller softwarescope:eqversion:8.1

Trust: 0.3

vendor:ciscomodel:wireless lan controller softwarescope:eqversion:8.0

Trust: 0.3

vendor:ciscomodel:series wireless controllersscope:eqversion:55008.5(124.32)

Trust: 0.3

vendor:ciscomodel:wireless lan controller softwarescope:neversion:8.8.120.0

Trust: 0.3

vendor:ciscomodel:wireless lan controller softwarescope:neversion:8.8.100.0

Trust: 0.3

vendor:ciscomodel:wireless lan controller softwarescope:neversion:8.5.140.0

Trust: 0.3

vendor:ciscomodel:wireless lan controller softwarescope:neversion:8.5.135.0

Trust: 0.3

vendor:ciscomodel:wireless lan controller softwarescope:neversion:8.3.150.0

Trust: 0.3

sources: BID: 107998 // JVNDB: JVNDB-2019-003529 // NVD: CVE-2019-1797

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-1797
value: HIGH

Trust: 1.0

ykramarz@cisco.com: CVE-2019-1797
value: HIGH

Trust: 1.0

NVD: CVE-2019-1797
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201904-858
value: HIGH

Trust: 0.6

VULHUB: VHN-150269
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-1797
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-150269
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-1797
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2019-1797
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.2
version: 3.0

Trust: 1.0

NVD: CVE-2019-1797
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-150269 // JVNDB: JVNDB-2019-003529 // CNNVD: CNNVD-201904-858 // NVD: CVE-2019-1797 // NVD: CVE-2019-1797

PROBLEMTYPE DATA

problemtype:CWE-352

Trust: 1.9

sources: VULHUB: VHN-150269 // JVNDB: JVNDB-2019-003529 // NVD: CVE-2019-1797

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201904-858

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201904-858

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-003529

PATCH
title:cisco-sa-20190417-wlc-csrfurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-wlc-csrf
Trust: 0.8
title:Cisco Wireless LAN Controller Software Fixes for cross-site request forgery vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=91692
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-003529 // 
            
            
            
            CNNVD: CNNVD-201904-858

EXTERNAL IDS
db:NVDid:CVE-2019-1797
Trust: 2.8
db:BIDid:107998
Trust: 2.0
db:JVNDBid:JVNDB-2019-003529
Trust: 0.8
db:CNNVDid:CNNVD-201904-858
Trust: 0.7
db:AUSCERTid:ESB-2019.1333
Trust: 0.6
db:VULHUBid:VHN-150269
Trust: 0.1
sources:
            
            
            VULHUB: VHN-150269 // 
            
            
            
            BID: 107998 // 
            
            
            
            JVNDB: JVNDB-2019-003529 // 
            
            
            
            CNNVD: CNNVD-201904-858 // 
            
            
            
            NVD: CVE-2019-1797

REFERENCES
url:http://www.securityfocus.com/bid/107998
Trust: 2.3
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190417-wlc-csrf
Trust: 2.0
url:https://nvd.nist.gov/vuln/detail/cve-2019-1797
Trust: 1.4
url:http://www.cisco.com/
Trust: 0.9
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1797
Trust: 0.8
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190417-wlc-cert-dos
Trust: 0.6
url:https://vigilance.fr/vulnerability/cisco-wireless-lan-controller-cross-site-request-forgery-29090
Trust: 0.6
url:https://www.auscert.org.au/bulletins/79298
Trust: 0.6
sources:
            
            
            VULHUB: VHN-150269 // 
            
            
            
            BID: 107998 // 
            
            
            
            JVNDB: JVNDB-2019-003529 // 
            
            
            
            CNNVD: CNNVD-201904-858 // 
            
            
            
            NVD: CVE-2019-1797

CREDITS
Cisco
Trust: 0.9
sources:
            
            
            BID: 107998 // 
            
            
            
            CNNVD: CNNVD-201904-858

SOURCES
db:VULHUBid:VHN-150269
db:BIDid:107998
db:JVNDBid:JVNDB-2019-003529
db:CNNVDid:CNNVD-201904-858
db:NVDid:CVE-2019-1797

LAST UPDATE DATE
2024-11-23T22:17:05.347000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-150269date:2019-10-09T00:00:00
db:BIDid:107998date:2019-04-17T00:00:00
db:JVNDBid:JVNDB-2019-003529date:2019-05-20T00:00:00
db:CNNVDid:CNNVD-201904-858date:2019-04-22T00:00:00
db:NVDid:CVE-2019-1797date:2024-11-21T04:37:24.127

SOURCES RELEASE DATE
db:VULHUBid:VHN-150269date:2019-04-18T00:00:00
db:BIDid:107998date:2019-04-17T00:00:00
db:JVNDBid:JVNDB-2019-003529date:2019-05-20T00:00:00
db:CNNVDid:CNNVD-201904-858date:2019-04-17T00:00:00
db:NVDid:CVE-2019-1797date:2019-04-18T01:29:02.563