Details of VAR-202001-0782

ID

VAR-202001-0782

CVE

CVE-2019-15982

TITLE

Cisco Data Center Network Manager Path traversal vulnerability

Trust: 1.4

sources: JVNDB: JVNDB-2019-013735 // CNNVD: CNNVD-202001-030

DESCRIPTION

Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. To exploit these vulnerabilities, an attacker would need administrative privileges on the DCNM application. For more information about these vulnerabilities, see the Details section of this advisory. Note: The severity of these vulnerabilities is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the processing of requests to the upload endpoint. When parsing the file parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. The system is available for Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting functions. A path traversal vulnerability exists in the Application Framework functionality in Cisco DCNM releases prior to 11.3(1) due to insufficient validation of user input sent to Application Framework endpoints

Trust: 2.34

sources: NVD: CVE-2019-15982 // JVNDB: JVNDB-2019-013735 // ZDI: ZDI-20-103 // VULHUB: VHN-148083

AFFECTED PRODUCTS

vendor:	cisco	model:	data center network manager	scope:	-	version:	-	Trust: 1.5
vendor:	cisco	model:	data center network manager	scope:	lt	version:	11.3\(1\)	Trust: 1.0
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.31	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	4.0	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.41	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.21	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	5.0	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.1	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	4.1	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.42	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.0	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	4.2	Trust: 0.6

sources: ZDI: ZDI-20-103 // JVNDB: JVNDB-2019-013735 // CNNVD: CNNVD-202001-030 // NVD: CVE-2019-15982

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-15982
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-15982
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-15982
value:	HIGH
Trust: 0.8
ZDI:	CVE-2019-15982
value:	HIGH
Trust: 0.7
CNNVD:	CNNVD-202001-030
value:	HIGH
Trust: 0.6
VULHUB:	VHN-148083
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2019-15982
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-148083
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

ykramarz@cisco.com:	CVE-2019-15982
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.0
Trust: 1.8
nvd@nist.gov:	CVE-2019-15982
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.1
Trust: 1.0
ZDI:	CVE-2019-15982
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.0
Trust: 0.7

sources: ZDI: ZDI-20-103 // VULHUB: VHN-148083 // JVNDB: JVNDB-2019-013735 // CNNVD: CNNVD-202001-030 // NVD: CVE-2019-15982 // NVD: CVE-2019-15982

PROBLEMTYPE DATA

problemtype:

CWE-22

Trust: 1.9

sources: VULHUB: VHN-148083 // JVNDB: JVNDB-2019-013735 // NVD: CVE-2019-15982

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202001-030

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-202001-030

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-013735

PATCH

title:	cisco-sa-20200102-dcnm-path-trav	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-path-trav	Trust: 1.5
title:	Cisco Data Center Network Manager Repair measures for path traversal vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=106176	Trust: 0.6

sources: ZDI: ZDI-20-103 // JVNDB: JVNDB-2019-013735 // CNNVD: CNNVD-202001-030

EXTERNAL IDS

db:	NVD	id:	CVE-2019-15982	Trust: 3.2
db:	ZDI	id:	ZDI-20-103	Trust: 1.3
db:	JVNDB	id:	JVNDB-2019-013735	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-9305	Trust: 0.7
db:	CNNVD	id:	CNNVD-202001-030	Trust: 0.7
db:	AUSCERT	id:	ESB-2020.0034	Trust: 0.6
db:	VULHUB	id:	VHN-148083	Trust: 0.1

sources: ZDI: ZDI-20-103 // VULHUB: VHN-148083 // JVNDB: JVNDB-2019-013735 // CNNVD: CNNVD-202001-030 // NVD: CVE-2019-15982

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20200102-dcnm-path-trav	Trust: 2.4
url:	https://nvd.nist.gov/vuln/detail/cve-2019-15982	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-15982	Trust: 0.8
url:	https://vigilance.fr/vulnerability/cisco-data-center-network-manager-directory-traversal-via-rest-soap-31254	Trust: 0.6
url:	https://www.zerodayinitiative.com/advisories/zdi-20-103/	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.0034/	Trust: 0.6

sources: ZDI: ZDI-20-103 // VULHUB: VHN-148083 // JVNDB: JVNDB-2019-013735 // CNNVD: CNNVD-202001-030 // NVD: CVE-2019-15982

CREDITS

Steven Seeley (mr_me) of Source Incite

Trust: 0.7

sources: ZDI: ZDI-20-103

SOURCES

db:	ZDI	id:	ZDI-20-103
db:	VULHUB	id:	VHN-148083
db:	JVNDB	id:	JVNDB-2019-013735
db:	CNNVD	id:	CNNVD-202001-030
db:	NVD	id:	CVE-2019-15982

LAST UPDATE DATE

2024-11-23T21:59:31.719000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-20-103	date:	2020-01-03T00:00:00
db:	VULHUB	id:	VHN-148083	date:	2020-01-08T00:00:00
db:	JVNDB	id:	JVNDB-2019-013735	date:	2020-01-15T00:00:00
db:	CNNVD	id:	CNNVD-202001-030	date:	2020-01-17T00:00:00
db:	NVD	id:	CVE-2019-15982	date:	2024-11-21T04:29:52.033

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-20-103	date:	2020-01-03T00:00:00
db:	VULHUB	id:	VHN-148083	date:	2020-01-06T00:00:00
db:	JVNDB	id:	JVNDB-2019-013735	date:	2020-01-15T00:00:00
db:	CNNVD	id:	CNNVD-202001-030	date:	2020-01-02T00:00:00
db:	NVD	id:	CVE-2019-15982	date:	2020-01-06T08:15:11.283