Details of VAR-201911-0945

ID

VAR-201911-0945

CVE

CVE-2019-15996

TITLE

Cisco DNA Spaces: Connector Vulnerability in Permission Management

Trust: 0.8

sources: JVNDB: JVNDB-2019-012697

DESCRIPTION

A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient restrictions during the execution of an affected CLI command. An attacker could exploit this vulnerability by leveraging the insufficient restrictions to modify sensitive files. A successful exploit could allow the attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. Cisco DNA Spaces: Connector Contains a privilege management vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Cisco DNA Spaces is an indoor positioning service platform of Cisco (Cisco). Cisco DNA Spaces: Connector is one of the connectors used to support Cisco wireless controller communication. Cisco DNA Spaces: Permissions and access control issues exist in versions prior to Connector 2.1

Trust: 1.71

sources: NVD: CVE-2019-15996 // JVNDB: JVNDB-2019-012697 // VULHUB: VHN-148098

AFFECTED PRODUCTS

vendor:	cisco	model:	dna spaces\: connector	scope:	lt	version:	2.1	Trust: 1.0
vendor:	cisco	model:	dna spaces: connector	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2019-012697 // NVD: CVE-2019-15996

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-15996
value:	MEDIUM
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-15996
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-15996
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201911-1191
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-148098
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2019-15996
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-148098
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

ykramarz@cisco.com:	CVE-2019-15996
baseSeverity:	MEDIUM
baseScore:	6.7
vectorString:	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.8
impactScore:	5.9
version:	3.0
Trust: 1.8
nvd@nist.gov:	CVE-2019-15996
baseSeverity:	MEDIUM
baseScore:	6.7
vectorString:	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.8
impactScore:	5.9
version:	3.1
Trust: 1.0

sources: VULHUB: VHN-148098 // JVNDB: JVNDB-2019-012697 // CNNVD: CNNVD-201911-1191 // NVD: CVE-2019-15996 // NVD: CVE-2019-15996

PROBLEMTYPE DATA

problemtype:	CWE-78	Trust: 1.1
problemtype:	CWE-264	Trust: 1.0
problemtype:	CWE-269	Trust: 0.9

sources: VULHUB: VHN-148098 // JVNDB: JVNDB-2019-012697 // NVD: CVE-2019-15996

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201911-1191

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201911-1191

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-012697

PATCH

title:	cisco-sa-20191120-dna-priv-esca	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-dna-priv-esca	Trust: 0.8
title:	Cisco DNA Spaces:Connector Fixes for permissions and access control issues vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=103134	Trust: 0.6

sources: JVNDB: JVNDB-2019-012697 // CNNVD: CNNVD-201911-1191

EXTERNAL IDS

db:	NVD	id:	CVE-2019-15996	Trust: 2.5
db:	JVNDB	id:	JVNDB-2019-012697	Trust: 0.8
db:	CNNVD	id:	CNNVD-201911-1191	Trust: 0.7
db:	AUSCERT	id:	ESB-2019.4392	Trust: 0.6
db:	VULHUB	id:	VHN-148098	Trust: 0.1

sources: VULHUB: VHN-148098 // JVNDB: JVNDB-2019-012697 // CNNVD: CNNVD-201911-1191 // NVD: CVE-2019-15996

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20191120-dna-priv-esca	Trust: 2.3
url:	https://nvd.nist.gov/vuln/detail/cve-2019-15996	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-15996	Trust: 0.8
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20191120-dna-cmd-injection	Trust: 0.6
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20191120-dna-sqlinjection	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2019.4392/	Trust: 0.6

sources: VULHUB: VHN-148098 // JVNDB: JVNDB-2019-012697 // CNNVD: CNNVD-201911-1191 // NVD: CVE-2019-15996

SOURCES

db:	VULHUB	id:	VHN-148098
db:	JVNDB	id:	JVNDB-2019-012697
db:	CNNVD	id:	CNNVD-201911-1191
db:	NVD	id:	CVE-2019-15996

LAST UPDATE DATE

2024-11-23T22:16:46.808000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-148098	date:	2020-10-16T00:00:00
db:	JVNDB	id:	JVNDB-2019-012697	date:	2019-12-11T00:00:00
db:	CNNVD	id:	CNNVD-201911-1191	date:	2020-10-21T00:00:00
db:	NVD	id:	CVE-2019-15996	date:	2024-11-21T04:29:53.853

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-148098	date:	2019-11-26T00:00:00
db:	JVNDB	id:	JVNDB-2019-012697	date:	2019-12-11T00:00:00
db:	CNNVD	id:	CNNVD-201911-1191	date:	2019-11-20T00:00:00
db:	NVD	id:	CVE-2019-15996	date:	2019-11-26T04:15:12.357