ID

VAR-201911-1051


CVE

CVE-2019-1982


TITLE

plural Cisco Inappropriate default permission vulnerability in the product

Trust: 0.8

sources: JVNDB: JVNDB-2019-011706

DESCRIPTION

A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due to improper handling of HTTP requests, including those communicated over a secure HTTPS connection, that contain maliciously crafted headers. An attacker could exploit this vulnerability by sending malicious requests to an affected device. An exploit could allow the attacker to bypass filtering and deliver malicious requests to protected systems, allowing attackers to deliver malicious content that would otherwise be blocked. Cisco Firepower Management Center (FMC) and others are products of Cisco (Cisco). passed request)

Trust: 1.8

sources: NVD: CVE-2019-1982 // JVNDB: JVNDB-2019-011706 // VULHUB: VHN-152304 // VULMON: CVE-2019-1982

AFFECTED PRODUCTS

vendor:ciscomodel:firepower management centerscope:eqversion:2.9.14.0

Trust: 1.0

vendor:ciscomodel:firepower management centerscope:eqversion:3.0.0

Trust: 1.0

vendor:ciscomodel:firepower management centerscope:eqversion:2.9.13

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:eqversion: -

Trust: 1.0

vendor:ciscomodel:firepower services software for asascope:eqversion: -

Trust: 1.0

vendor:ciscomodel:firepower management centerscope: - version: -

Trust: 0.8

vendor:ciscomodel:firepower services for asascope: - version: -

Trust: 0.8

vendor:ciscomodel:firepower threat defense softwarescope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2019-011706 // NVD: CVE-2019-1982

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-1982
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2019-1982
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-1982
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201908-1158
value: MEDIUM

Trust: 0.6

VULHUB: VHN-152304
value: MEDIUM

Trust: 0.1

VULMON: CVE-2019-1982
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-1982
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-152304
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-1982
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2019-1982
baseSeverity: MEDIUM
baseScore: 5.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.0

Trust: 1.0

NVD: CVE-2019-1982
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-152304 // VULMON: CVE-2019-1982 // JVNDB: JVNDB-2019-011706 // CNNVD: CNNVD-201908-1158 // NVD: CVE-2019-1982 // NVD: CVE-2019-1982

PROBLEMTYPE DATA

problemtype:CWE-276

Trust: 1.9

problemtype:CWE-264

Trust: 1.8

sources: VULHUB: VHN-152304 // JVNDB: JVNDB-2019-011706 // NVD: CVE-2019-1982

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201908-1158

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201908-1158

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-011706

PATCH

title:cisco-sa-20190816-ftd-httpurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190816-ftd-http

Trust: 0.8

title:Cisco: Cisco Firepower Threat Defense Software HTTP Filtering Bypass Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20190816-ftd-http

Trust: 0.1

sources: VULMON: CVE-2019-1982 // JVNDB: JVNDB-2019-011706

EXTERNAL IDS

db:NVDid:CVE-2019-1982

Trust: 2.6

db:JVNDBid:JVNDB-2019-011706

Trust: 0.8

db:CNNVDid:CNNVD-201908-1158

Trust: 0.7

db:AUSCERTid:ESB-2019.3163

Trust: 0.6

db:VULHUBid:VHN-152304

Trust: 0.1

db:VULMONid:CVE-2019-1982

Trust: 0.1

sources: VULHUB: VHN-152304 // VULMON: CVE-2019-1982 // JVNDB: JVNDB-2019-011706 // CNNVD: CNNVD-201908-1158 // NVD: CVE-2019-1982

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2019-1982

Trust: 1.4

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190816-ftd-http

Trust: 1.3

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1982

Trust: 0.8

url:http

Trust: 0.6

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190816-ftd-null

Trust: 0.6

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190816-ftd-nspd

Trust: 0.6

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190816-ftd-srb

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2019.3163/

Trust: 0.6

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190816-ftd-

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/276.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-152304 // VULMON: CVE-2019-1982 // JVNDB: JVNDB-2019-011706 // CNNVD: CNNVD-201908-1158 // NVD: CVE-2019-1982

CREDITS

NSS Labs

Trust: 0.6

sources: CNNVD: CNNVD-201908-1158

SOURCES

db:VULHUBid:VHN-152304
db:VULMONid:CVE-2019-1982
db:JVNDBid:JVNDB-2019-011706
db:CNNVDid:CNNVD-201908-1158
db:NVDid:CVE-2019-1982

LAST UPDATE DATE

2024-08-14T13:55:00.931000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-152304date:2019-11-08T00:00:00
db:VULMONid:CVE-2019-1982date:2019-11-08T00:00:00
db:JVNDBid:JVNDB-2019-011706date:2019-11-15T00:00:00
db:CNNVDid:CNNVD-201908-1158date:2019-11-11T00:00:00
db:NVDid:CVE-2019-1982date:2019-11-08T19:47:45.017

SOURCES RELEASE DATE

db:VULHUBid:VHN-152304date:2019-11-05T00:00:00
db:VULMONid:CVE-2019-1982date:2019-11-05T00:00:00
db:JVNDBid:JVNDB-2019-011706date:2019-11-15T00:00:00
db:CNNVDid:CNNVD-201908-1158date:2019-08-16T00:00:00
db:NVDid:CVE-2019-1982date:2019-11-05T20:15:11.907