Details of VAR-202001-0778

ID

VAR-202001-0778

CVE

CVE-2019-15978

TITLE

Cisco Data Center Network Manager In OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-013739

DESCRIPTION

Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administrative privileges on the DCNM application to inject arbitrary commands on the underlying operating system (OS). For more information about these vulnerabilities, see the Details section of this advisory. Note: The severity of these vulnerabilities is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the processing of requests to the fabrics endpoint. When parsing the name parameter in the createLanFabric method, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. The vulnerability stems from insufficient input validation provided by the user to the API. The system is available for Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting functions

Trust: 2.88

sources: NVD: CVE-2019-15978 // JVNDB: JVNDB-2019-013739 // ZDI: ZDI-20-102 // CNVD: CNVD-2020-00288 // VULHUB: VHN-148078

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-00288

AFFECTED PRODUCTS

vendor:	cisco	model:	data center network manager	scope:	-	version:	-	Trust: 1.5
vendor:	cisco	model:	data center network manager	scope:	lt	version:	11.3\(1\)	Trust: 1.0
vendor:	cisco	model:	data center network manager	scope:	lt	version:	11.3(1)	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.31	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	4.0	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.41	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.21	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	5.0	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.1	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	4.1	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.42	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.0	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	4.2	Trust: 0.6

sources: ZDI: ZDI-20-102 // CNVD: CNVD-2020-00288 // JVNDB: JVNDB-2019-013739 // CNNVD: CNNVD-202001-029 // NVD: CVE-2019-15978

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-15978
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-15978
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-15978
value:	HIGH
Trust: 0.8
ZDI:	CVE-2019-15978
value:	HIGH
Trust: 0.7
CNVD:	CNVD-2020-00288
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202001-029
value:	HIGH
Trust: 0.6
VULHUB:	VHN-148078
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2019-15978
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2020-00288
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-148078
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

ykramarz@cisco.com:	CVE-2019-15978
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.0
Trust: 1.8
nvd@nist.gov:	CVE-2019-15978
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.1
Trust: 1.0
ZDI:	CVE-2019-15978
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.0
Trust: 0.7

sources: ZDI: ZDI-20-102 // CNVD: CNVD-2020-00288 // VULHUB: VHN-148078 // JVNDB: JVNDB-2019-013739 // CNNVD: CNNVD-202001-029 // NVD: CVE-2019-15978 // NVD: CVE-2019-15978

PROBLEMTYPE DATA

problemtype:

CWE-78

Trust: 1.9

sources: VULHUB: VHN-148078 // JVNDB: JVNDB-2019-013739 // NVD: CVE-2019-15978

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202001-029

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202001-029

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-013739

PATCH

title:	cisco-sa-20200102-dcnm-comm-inject	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-comm-inject	Trust: 1.5
title:	Patch for Cisco Data Center Network Manager REST API Command Injection Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/195951	Trust: 0.6
title:	Cisco Data Center Network Manager Fixes for operating system command injection vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=106175	Trust: 0.6

sources: ZDI: ZDI-20-102 // CNVD: CNVD-2020-00288 // JVNDB: JVNDB-2019-013739 // CNNVD: CNNVD-202001-029

EXTERNAL IDS

db:	NVD	id:	CVE-2019-15978	Trust: 3.8
db:	PACKETSTORM	id:	156242	Trust: 1.7
db:	ZDI	id:	ZDI-20-102	Trust: 1.3
db:	JVNDB	id:	JVNDB-2019-013739	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-9286	Trust: 0.7
db:	CNNVD	id:	CNNVD-202001-029	Trust: 0.7
db:	CNVD	id:	CNVD-2020-00288	Trust: 0.6
db:	AUSCERT	id:	ESB-2020.0037	Trust: 0.6
db:	EXPLOIT-DB	id:	48020	Trust: 0.6
db:	VULHUB	id:	VHN-148078	Trust: 0.1

sources: ZDI: ZDI-20-102 // CNVD: CNVD-2020-00288 // VULHUB: VHN-148078 // JVNDB: JVNDB-2019-013739 // CNNVD: CNNVD-202001-029 // NVD: CVE-2019-15978

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20200102-dcnm-comm-inject	Trust: 3.0
url:	http://packetstormsecurity.com/files/156242/cisco-data-center-network-manager-11.2.1-command-injection.html	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-15978	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-15978	Trust: 0.8
url:	https://vigilance.fr/vulnerability/cisco-data-center-network-manager-privilege-escalation-via-command-injection-31253	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.0037/	Trust: 0.6
url:	https://www.exploit-db.com/exploits/48020	Trust: 0.6
url:	https://www.zerodayinitiative.com/advisories/zdi-20-102/	Trust: 0.6

sources: ZDI: ZDI-20-102 // CNVD: CNVD-2020-00288 // VULHUB: VHN-148078 // JVNDB: JVNDB-2019-013739 // CNNVD: CNNVD-202001-029 // NVD: CVE-2019-15978

CREDITS

Steven Seeley (mr_me) of Source Incite

Trust: 0.7

sources: ZDI: ZDI-20-102

SOURCES

db:	ZDI	id:	ZDI-20-102
db:	CNVD	id:	CNVD-2020-00288
db:	VULHUB	id:	VHN-148078
db:	JVNDB	id:	JVNDB-2019-013739
db:	CNNVD	id:	CNNVD-202001-029
db:	NVD	id:	CVE-2019-15978

LAST UPDATE DATE

2024-08-14T14:12:01.933000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-20-102	date:	2020-01-03T00:00:00
db:	CNVD	id:	CNVD-2020-00288	date:	2020-01-03T00:00:00
db:	VULHUB	id:	VHN-148078	date:	2023-02-03T00:00:00
db:	JVNDB	id:	JVNDB-2019-013739	date:	2020-01-15T00:00:00
db:	CNNVD	id:	CNNVD-202001-029	date:	2020-02-11T00:00:00
db:	NVD	id:	CVE-2019-15978	date:	2023-02-03T17:26:42.373

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-20-102	date:	2020-01-03T00:00:00
db:	CNVD	id:	CNVD-2020-00288	date:	2020-01-03T00:00:00
db:	VULHUB	id:	VHN-148078	date:	2020-01-06T00:00:00
db:	JVNDB	id:	JVNDB-2019-013739	date:	2020-01-15T00:00:00
db:	CNNVD	id:	CNNVD-202001-029	date:	2020-01-02T00:00:00
db:	NVD	id:	CVE-2019-15978	date:	2020-01-06T08:15:10.973