Details of VAR-202001-0781

ID

VAR-202001-0781

CVE

CVE-2019-15981

TITLE

Cisco Data Center Network Manager Path traversal vulnerability

Trust: 1.4

sources: JVNDB: JVNDB-2019-013742 // CNNVD: CNNVD-202001-032

DESCRIPTION

Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. To exploit these vulnerabilities, an attacker would need administrative privileges on the DCNM application. For more information about these vulnerabilities, see the Details section of this advisory. Note: The severity of these vulnerabilities is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the SOAP storeConfigToFS endpoint of the WebAnalysisWSService/WebAnalysisWS path in the service. When parsing the arg0 parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM and to create a denial-of-service condition. The vulnerability stems from insufficient input validation provided by the user to the API. A remotely authenticated attacker with administrative rights can exploit this vulnerability by sending a specially crafted request to the API to read, write to any file, or execute any file in the system with full administrative rights. The system is available for Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting functions

Trust: 4.77

sources: NVD: CVE-2019-15981 // JVNDB: JVNDB-2019-013742 // ZDI: ZDI-20-015 // ZDI: ZDI-20-009 // ZDI: ZDI-20-014 // ZDI: ZDI-20-010 // CNVD: CNVD-2020-00280 // VULHUB: VHN-148082

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-00280

AFFECTED PRODUCTS

vendor:	cisco	model:	data center network manager	scope:	-	version:	-	Trust: 3.6
vendor:	cisco	model:	data center network manager	scope:	lt	version:	11.3\(1\)	Trust: 1.0
vendor:	cisco	model:	data center network manager	scope:	lt	version:	11.3(1)	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.31	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	4.0	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.41	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.21	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	5.0	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.1	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	4.1	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.42	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.0	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	4.2	Trust: 0.6

sources: ZDI: ZDI-20-015 // ZDI: ZDI-20-009 // ZDI: ZDI-20-014 // ZDI: ZDI-20-010 // CNVD: CNVD-2020-00280 // JVNDB: JVNDB-2019-013742 // CNNVD: CNNVD-202001-032 // NVD: CVE-2019-15981

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI:	CVE-2019-15981
value:	MEDIUM
Trust: 1.4
ZDI:	CVE-2019-15981
value:	HIGH
Trust: 1.4
nvd@nist.gov:	CVE-2019-15981
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-15981
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-15981
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2020-00280
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202001-032
value:	HIGH
Trust: 0.6
VULHUB:	VHN-148082
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2019-15981
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2020-00280
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-148082
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

ykramarz@cisco.com:	CVE-2019-15981
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.0
Trust: 1.8
ZDI:	CVE-2019-15981
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.0
Trust: 1.4
ZDI:	CVE-2019-15981
baseSeverity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	LOW
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	4.2
version:	3.0
Trust: 1.4
nvd@nist.gov:	CVE-2019-15981
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.1
Trust: 1.0

sources: ZDI: ZDI-20-015 // ZDI: ZDI-20-009 // ZDI: ZDI-20-014 // ZDI: ZDI-20-010 // CNVD: CNVD-2020-00280 // VULHUB: VHN-148082 // JVNDB: JVNDB-2019-013742 // CNNVD: CNNVD-202001-032 // NVD: CVE-2019-15981 // NVD: CVE-2019-15981

PROBLEMTYPE DATA

problemtype:

CWE-22

Trust: 1.9

sources: VULHUB: VHN-148082 // JVNDB: JVNDB-2019-013742 // NVD: CVE-2019-15981

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202001-032

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-202001-032

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-013742

PATCH

title:	cisco-sa-20200102-dcnm-path-trav	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-path-trav	Trust: 3.6
title:	Patch for Cisco Data Center Network Manager SOAP API Path Traversal Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/195957	Trust: 0.6
title:	Cisco Data Center Network Manager Repair measures for path traversal vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=106178	Trust: 0.6

sources: ZDI: ZDI-20-015 // ZDI: ZDI-20-009 // ZDI: ZDI-20-014 // ZDI: ZDI-20-010 // CNVD: CNVD-2020-00280 // JVNDB: JVNDB-2019-013742 // CNNVD: CNNVD-202001-032

EXTERNAL IDS

db:	NVD	id:	CVE-2019-15981	Trust: 5.9
db:	ZDI	id:	ZDI-20-015	Trust: 1.3
db:	JVNDB	id:	JVNDB-2019-013742	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-9139	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9157	Trust: 0.7
db:	ZDI	id:	ZDI-20-009	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9130	Trust: 0.7
db:	ZDI	id:	ZDI-20-014	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9158	Trust: 0.7
db:	ZDI	id:	ZDI-20-010	Trust: 0.7
db:	CNNVD	id:	CNNVD-202001-032	Trust: 0.7
db:	CNVD	id:	CNVD-2020-00280	Trust: 0.6
db:	AUSCERT	id:	ESB-2020.0034	Trust: 0.6
db:	VULHUB	id:	VHN-148082	Trust: 0.1

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20200102-dcnm-path-trav	Trust: 5.1
url:	https://nvd.nist.gov/vuln/detail/cve-2019-15981	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-15981	Trust: 0.8
url:	https://vigilance.fr/vulnerability/cisco-data-center-network-manager-directory-traversal-via-rest-soap-31254	Trust: 0.6
url:	https://www.zerodayinitiative.com/advisories/zdi-20-015/	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.0034/	Trust: 0.6

CREDITS

Steven Seeley (mr_me) of Source Incite

Trust: 2.8

sources: ZDI: ZDI-20-015 // ZDI: ZDI-20-009 // ZDI: ZDI-20-014 // ZDI: ZDI-20-010

SOURCES

db:	ZDI	id:	ZDI-20-015
db:	ZDI	id:	ZDI-20-009
db:	ZDI	id:	ZDI-20-014
db:	ZDI	id:	ZDI-20-010
db:	CNVD	id:	CNVD-2020-00280
db:	VULHUB	id:	VHN-148082
db:	JVNDB	id:	JVNDB-2019-013742
db:	CNNVD	id:	CNNVD-202001-032
db:	NVD	id:	CVE-2019-15981

LAST UPDATE DATE

2024-08-14T13:25:07.787000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-20-015	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-009	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-014	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-010	date:	2020-01-03T00:00:00
db:	CNVD	id:	CNVD-2020-00280	date:	2020-01-03T00:00:00
db:	VULHUB	id:	VHN-148082	date:	2020-01-08T00:00:00
db:	JVNDB	id:	JVNDB-2019-013742	date:	2020-01-15T00:00:00
db:	CNNVD	id:	CNNVD-202001-032	date:	2020-01-17T00:00:00
db:	NVD	id:	CVE-2019-15981	date:	2020-01-08T19:33:28.957

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-20-015	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-009	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-014	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-010	date:	2020-01-03T00:00:00
db:	CNVD	id:	CNVD-2020-00280	date:	2020-01-03T00:00:00
db:	VULHUB	id:	VHN-148082	date:	2020-01-06T00:00:00
db:	JVNDB	id:	JVNDB-2019-013742	date:	2020-01-15T00:00:00
db:	CNNVD	id:	CNNVD-202001-032	date:	2020-01-02T00:00:00
db:	NVD	id:	CVE-2019-15981	date:	2020-01-06T08:15:11.223