Details of VAR-202001-0783

ID

VAR-202001-0783

CVE

CVE-2019-15983

TITLE

Cisco Data Center Network Manager In XML External entity vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2019-013736

DESCRIPTION

A vulnerability in the SOAP API of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. To exploit this vulnerability, an attacker would need administrative privileges on the DCNM application. The vulnerability exists because the SOAP API improperly handles XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by inserting malicious XML content in an API request. A successful exploit could allow the attacker to read arbitrary files from the affected device. Note: The severity of this vulnerability is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one. Authentication is not required to exploit this vulnerability.The specific flaw exists within the processing of requests to the getInventoryIslList SOAP endpoint of DashboardWSService/DashboardWS. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker could leverage this vulnerability to disclose stored credentials, leading to further compromise. The system is available for Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting functions

Trust: 4.77

sources: NVD: CVE-2019-15983 // JVNDB: JVNDB-2019-013736 // ZDI: ZDI-20-120 // ZDI: ZDI-20-117 // ZDI: ZDI-20-114 // ZDI: ZDI-20-119 // CNVD: CNVD-2020-00287 // VULHUB: VHN-148084

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-00287

AFFECTED PRODUCTS

vendor:	cisco	model:	data center network manager	scope:	-	version:	-	Trust: 3.6
vendor:	cisco	model:	data center network manager	scope:	lt	version:	11.3\(1\)	Trust: 1.0
vendor:	cisco	model:	data center network manager	scope:	lt	version:	11.3(1)	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.31	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	4.0	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.41	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.21	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	5.0	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.1	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	4.1	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.42	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	10.0	Trust: 0.6
vendor:	cisco	model:	data center network manager	scope:	eq	version:	4.2	Trust: 0.6

sources: ZDI: ZDI-20-120 // ZDI: ZDI-20-117 // ZDI: ZDI-20-114 // ZDI: ZDI-20-119 // CNVD: CNVD-2020-00287 // JVNDB: JVNDB-2019-013736 // CNNVD: CNNVD-202001-025 // NVD: CVE-2019-15983

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI:	CVE-2019-15983
value:	HIGH
Trust: 2.1
nvd@nist.gov:	CVE-2019-15983
value:	MEDIUM
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-15983
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-15983
value:	MEDIUM
Trust: 0.8
ZDI:	CVE-2019-15983
value:	MEDIUM
Trust: 0.7
CNVD:	CNVD-2020-00287
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202001-025
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-148084
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-15983
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2020-00287
severity:	MEDIUM
baseScore:	6.1
vectorString:	AV:N/AC:L/AU:M/C:C/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	MULTIPLE
confidentialityImpact:	COMPLETE
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	6.4
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-148084
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

ZDI:	CVE-2019-15983
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 2.1
ykramarz@cisco.com:	CVE-2019-15983
baseSeverity:	MEDIUM
baseScore:	4.9
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	1.2
impactScore:	3.6
version:	3.0
Trust: 1.8
nvd@nist.gov:	CVE-2019-15983
baseSeverity:	MEDIUM
baseScore:	4.9
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	1.2
impactScore:	3.6
version:	3.1
Trust: 1.0
ZDI:	CVE-2019-15983
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.0
Trust: 0.7

sources: ZDI: ZDI-20-120 // ZDI: ZDI-20-117 // ZDI: ZDI-20-114 // ZDI: ZDI-20-119 // CNVD: CNVD-2020-00287 // VULHUB: VHN-148084 // JVNDB: JVNDB-2019-013736 // CNNVD: CNNVD-202001-025 // NVD: CVE-2019-15983 // NVD: CVE-2019-15983

PROBLEMTYPE DATA

problemtype:

CWE-611

Trust: 1.9

sources: VULHUB: VHN-148084 // JVNDB: JVNDB-2019-013736 // NVD: CVE-2019-15983

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202001-025

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202001-025

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-013736

PATCH

title:	cisco-sa-20200102-dcnm-xml-ext-entity	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-xml-ext-entity	Trust: 3.6
title:	Patch for Cisco Data Center Network Manager XML External Entity Read Access Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/195949	Trust: 0.6
title:	Cisco Data Center Network Manager Fixes for code issue vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=106172	Trust: 0.6

sources: ZDI: ZDI-20-120 // ZDI: ZDI-20-117 // ZDI: ZDI-20-114 // ZDI: ZDI-20-119 // CNVD: CNVD-2020-00287 // JVNDB: JVNDB-2019-013736 // CNNVD: CNNVD-202001-025

EXTERNAL IDS

db:	NVD	id:	CVE-2019-15983	Trust: 5.9
db:	ZDI	id:	ZDI-20-120	Trust: 1.3
db:	JVNDB	id:	JVNDB-2019-013736	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-9248	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9425	Trust: 0.7
db:	ZDI	id:	ZDI-20-117	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9247	Trust: 0.7
db:	ZDI	id:	ZDI-20-114	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9285	Trust: 0.7
db:	ZDI	id:	ZDI-20-119	Trust: 0.7
db:	CNNVD	id:	CNNVD-202001-025	Trust: 0.7
db:	CNVD	id:	CNVD-2020-00287	Trust: 0.6
db:	AUSCERT	id:	ESB-2020.0038	Trust: 0.6
db:	VULHUB	id:	VHN-148084	Trust: 0.1

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20200102-dcnm-xml-ext-entity	Trust: 5.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-15983	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-15983	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2020.0038/	Trust: 0.6
url:	https://www.zerodayinitiative.com/advisories/zdi-20-120/	Trust: 0.6
url:	https://vigilance.fr/vulnerability/cisco-data-center-network-manager-external-xml-entity-injection-via-soap-api-31257	Trust: 0.6

CREDITS

Steven Seeley (mr_me) of Source Incite

Trust: 2.8

sources: ZDI: ZDI-20-120 // ZDI: ZDI-20-117 // ZDI: ZDI-20-114 // ZDI: ZDI-20-119

SOURCES

db:	ZDI	id:	ZDI-20-120
db:	ZDI	id:	ZDI-20-117
db:	ZDI	id:	ZDI-20-114
db:	ZDI	id:	ZDI-20-119
db:	CNVD	id:	CNVD-2020-00287
db:	VULHUB	id:	VHN-148084
db:	JVNDB	id:	JVNDB-2019-013736
db:	CNNVD	id:	CNNVD-202001-025
db:	NVD	id:	CVE-2019-15983

LAST UPDATE DATE

2024-08-14T13:44:27.448000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-20-120	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-117	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-114	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-119	date:	2020-01-03T00:00:00
db:	CNVD	id:	CNVD-2020-00287	date:	2020-01-03T00:00:00
db:	VULHUB	id:	VHN-148084	date:	2020-01-08T00:00:00
db:	JVNDB	id:	JVNDB-2019-013736	date:	2020-01-15T00:00:00
db:	CNNVD	id:	CNNVD-202001-025	date:	2020-01-17T00:00:00
db:	NVD	id:	CVE-2019-15983	date:	2020-01-08T20:56:50.347

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-20-120	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-117	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-114	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-119	date:	2020-01-03T00:00:00
db:	CNVD	id:	CNVD-2020-00287	date:	2020-01-03T00:00:00
db:	VULHUB	id:	VHN-148084	date:	2020-01-06T00:00:00
db:	JVNDB	id:	JVNDB-2019-013736	date:	2020-01-15T00:00:00
db:	CNNVD	id:	CNNVD-202001-025	date:	2020-01-02T00:00:00
db:	NVD	id:	CVE-2019-15983	date:	2020-01-06T08:15:11.363