Sign-up

ID

VAR-201911-1327


CVE

CVE-2019-1734


TITLE

Cisco FXOS and NX-OS Information disclosure vulnerability in software

Trust: 0.8

sources: JVNDB: JVNDB-2019-011854

DESCRIPTION

A vulnerability in the implementation of a CLI diagnostic command in Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to view sensitive system files that should be restricted. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to incomplete role-based access control (RBAC) verification. An attacker could exploit this vulnerability by authenticating to the device and issuing a specific CLI diagnostic command with crafted user-input parameters. An exploit could allow the attacker to perform an arbitrary read of a file on the device, and the file may contain sensitive information. The attacker needs valid device credentials to exploit this vulnerability. Cisco FXOS and NX-OS The software contains an information disclosure vulnerability.Information may be obtained. This issue is being tracked by Cisco Bug IDs CSCvj59436, CSCvk50808, CSCvk50810, CSCvk50814, CSCvk50816 and CSCvk50838

Trust: 1.89

sources: NVD: CVE-2019-1734 // JVNDB: JVNDB-2019-011854 // BID: 108381

AFFECTED PRODUCTS

vendor:ciscomodel:nx-osscope:gteversion:7.0\(3\)i7

Trust: 1.0

vendor:ciscomodel:firepower extensible operating systemscope:gteversion:2.4

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:6.0\(2\)a4\(1\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:gteversion:7.0\(3\)i4

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:7.0\(3\)i7\(6\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:6.2\(7\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:gteversion:7.2

Trust: 1.0

vendor:ciscomodel:firepower extensible operating systemscope:ltversion:2.3.1.111

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:4.0\(1a\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:6.2\(6\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:7.3\(0\)n1\(1\)

Trust: 1.0

vendor:ciscomodel:firepower extensible operating systemscope:ltversion:2.4.1.101

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:7.0\(3\)i4\(9\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:gteversion:7.0\(3\)

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:7.1\(4\)n1\(1\)

Trust: 1.0

vendor:ciscomodel:firepower extensible operating systemscope:gteversion:2.3

Trust: 1.0

vendor:ciscomodel:nx-osscope:ltversion:7.0\(3\)f3\(5\)

Trust: 1.0

vendor:ciscomodel:firepower extensible operating systemscope:ltversion:2.2.2.91

Trust: 1.0

vendor:ciscomodel:nx-osscope: - version: -

Trust: 0.8

vendor:ciscomodel:fx-osscope: - version: -

Trust: 0.8

vendor:ciscomodel:ucs series fabric interconnectsscope:eqversion:63000

Trust: 0.3

vendor:ciscomodel:ucs series fabric interconnectsscope:eqversion:62000

Trust: 0.3

vendor:ciscomodel:nx-osscope:eqversion:7.3

Trust: 0.3

vendor:ciscomodel:nx-osscope:eqversion:7.2

Trust: 0.3

vendor:ciscomodel:nx-osscope:eqversion:7.1

Trust: 0.3

vendor:ciscomodel:nx-os 7.0 i7scope: - version: -

Trust: 0.3

vendor:ciscomodel:nx-os 7.0 i4scope: - version: -

Trust: 0.3

vendor:ciscomodel:nx-osscope:eqversion:7.0(3)

Trust: 0.3

vendor:ciscomodel:nx-osscope:eqversion:6.2

Trust: 0.3

vendor:ciscomodel:nx-os 6.0 ascope: - version: -

Trust: 0.3

vendor:ciscomodel:nx-osscope:eqversion:4.0

Trust: 0.3

vendor:ciscomodel:nexus r-series switching platformscope:eqversion:95000

Trust: 0.3

vendor:ciscomodel:nexus series switches standalone nx-os modescope:eqversion:9000-0

Trust: 0.3

vendor:ciscomodel:nexus series switchesscope:eqversion:77000

Trust: 0.3

vendor:ciscomodel:nexus series switchesscope:eqversion:70000

Trust: 0.3

vendor:ciscomodel:nexus series switchesscope:eqversion:60000

Trust: 0.3

vendor:ciscomodel:nexus platform switchesscope:eqversion:56000

Trust: 0.3

vendor:ciscomodel:nexus platform switchesscope:eqversion:55000

Trust: 0.3

vendor:ciscomodel:nexus platform switchesscope:eqversion:36000

Trust: 0.3

vendor:ciscomodel:nexus platform switchesscope:eqversion:35000

Trust: 0.3

vendor:ciscomodel:nexus series switchesscope:eqversion:30000

Trust: 0.3

vendor:ciscomodel:mds series multilayer switchesscope:eqversion:90000

Trust: 0.3

vendor:ciscomodel:fxosscope:eqversion:2.4

Trust: 0.3

vendor:ciscomodel:fxosscope:eqversion:2.3

Trust: 0.3

vendor:ciscomodel:fxosscope:eqversion:2.2

Trust: 0.3

vendor:ciscomodel:firepower security appliancesscope:eqversion:93000

Trust: 0.3

vendor:ciscomodel:firepower seriesscope:eqversion:41000

Trust: 0.3

vendor:ciscomodel:nx-os 7.3 n1scope:neversion: -

Trust: 0.3

vendor:ciscomodel:nx-os 7.1 n1scope:neversion: -

Trust: 0.3

vendor:ciscomodel:nx-os 7.0 i7scope:neversion: -

Trust: 0.3

vendor:ciscomodel:nx-os 7.0 i4scope:neversion: -

Trust: 0.3

vendor:ciscomodel:nx-os 7.0 f3scope:neversion: -

Trust: 0.3

vendor:ciscomodel:nx-osscope:neversion:6.2(7)

Trust: 0.3

vendor:ciscomodel:nx-osscope:neversion:6.2(6)

Trust: 0.3

vendor:ciscomodel:nx-os 6.0 a4scope:neversion: -

Trust: 0.3

vendor:ciscomodel:nx-os 4.0scope:neversion: -

Trust: 0.3

vendor:ciscomodel:fxosscope:neversion:2.4.1.101

Trust: 0.3

vendor:ciscomodel:fxosscope:neversion:2.3.1.111

Trust: 0.3

vendor:ciscomodel:fxosscope:neversion:2.2.2.91

Trust: 0.3

sources: BID: 108381 // JVNDB: JVNDB-2019-011854 // NVD: CVE-2019-1734

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-1734
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2019-1734
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-1734
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201905-723
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2019-1734
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

ykramarz@cisco.com: CVE-2019-1734
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2019-1734
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

sources: JVNDB: JVNDB-2019-011854 // CNNVD: CNNVD-201905-723 // NVD: CVE-2019-1734 // NVD: CVE-2019-1734

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.8

problemtype:NVD-CWE-Other

Trust: 1.0

sources: JVNDB: JVNDB-2019-011854 // NVD: CVE-2019-1734

THREAT TYPE

local

Trust: 0.9

sources: BID: 108381 // CNNVD: CNNVD-201905-723

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201905-723

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-011854

PATCH
title:cisco-sa-20190515-nxos-fxos-infourl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-fxos-info
Trust: 0.8
title:Cisco FXOS Software  and Cisco NX-OS Software Repair measures for information disclosure vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=92856
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-011854 // 
            
            
            
            CNNVD: CNNVD-201905-723

EXTERNAL IDS
db:NVDid:CVE-2019-1734
Trust: 2.7
db:BIDid:108381
Trust: 0.9
db:JVNDBid:JVNDB-2019-011854
Trust: 0.8
db:AUSCERTid:ESB-2019.1759.4
Trust: 0.6
db:AUSCERTid:ESB-2019.1759.3
Trust: 0.6
db:AUSCERTid:ESB-2019.1759.5
Trust: 0.6
db:CNNVDid:CNNVD-201905-723
Trust: 0.6
sources:
            
            
            BID: 108381 // 
            
            
            
            JVNDB: JVNDB-2019-011854 // 
            
            
            
            CNNVD: CNNVD-201905-723 // 
            
            
            
            NVD: CVE-2019-1734

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-fxos-info
Trust: 2.5
url:https://nvd.nist.gov/vuln/detail/cve-2019-1734
Trust: 1.4
url:https://www.securityfocus.com/bid/108381
Trust: 1.2
url:http://www.cisco.com/
Trust: 0.9
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1734
Trust: 0.8
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-fxos-nxos-cmdinj-1781-1782
Trust: 0.6
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-snmp-dos
Trust: 0.6
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-conf-bypass
Trust: 0.6
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-cmdinj-1795
Trust: 0.6
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-fxos-cmdinj-1780
Trust: 0.6
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-fxos-cmdinj-1779
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.1759.5/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.1759.4/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.1759.3/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/81118
Trust: 0.6
sources:
            
            
            BID: 108381 // 
            
            
            
            JVNDB: JVNDB-2019-011854 // 
            
            
            
            CNNVD: CNNVD-201905-723 // 
            
            
            
            NVD: CVE-2019-1734

CREDITS
Cisco.
Trust: 0.9
sources:
            
            
            BID: 108381 // 
            
            
            
            CNNVD: CNNVD-201905-723

SOURCES
db:BIDid:108381
db:JVNDBid:JVNDB-2019-011854
db:CNNVDid:CNNVD-201905-723
db:NVDid:CVE-2019-1734

LAST UPDATE DATE
2024-08-14T13:26:30.226000+00:00

SOURCES UPDATE DATE
db:BIDid:108381date:2019-05-15T00:00:00
db:JVNDBid:JVNDB-2019-011854date:2019-11-19T00:00:00
db:CNNVDid:CNNVD-201905-723date:2020-10-21T00:00:00
db:NVDid:CVE-2019-1734date:2023-04-20T15:27:48.130

SOURCES RELEASE DATE
db:BIDid:108381date:2019-05-15T00:00:00
db:JVNDBid:JVNDB-2019-011854date:2019-11-19T00:00:00
db:CNNVDid:CNNVD-201905-723date:2019-05-16T00:00:00
db:NVDid:CVE-2019-1734date:2019-11-05T20:15:11.297