Details of VAR-202001-0784

ID

VAR-202001-0784

CVE

CVE-2019-15984

TITLE

Cisco Data Center Network Manager getSwitchDbIdBySerialNumber SQL Injection Remote Code Execution Vulnerability

Trust: 0.7

sources: ZDI: ZDI-20-110

DESCRIPTION

Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. To exploit these vulnerabilities, an attacker would need administrative privileges on the DCNM application. For more information about these vulnerabilities, see the Details section of this advisory. Note: The severity of these vulnerabilities is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the processing of requests to the StatisticsWSService/StatisticsWS service. When parsing the sortType parameter of the getGigEStatList endpoint, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. The system is available for Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting functions. The REST API in versions prior to Cisco DCNM 11.3(1) has a SQL injection vulnerability due to insufficient validation of user input submitted to the API. A remote attacker could exploit this vulnerability to execute arbitrary SQL commands by sending a specially crafted request

Trust: 11.7

sources: NVD: CVE-2019-15984 // ZDI: ZDI-20-020 // ZDI: ZDI-20-074 // ZDI: ZDI-20-058 // ZDI: ZDI-20-115 // ZDI: ZDI-20-091 // ZDI: ZDI-20-042 // ZDI: ZDI-20-104 // ZDI: ZDI-20-022 // ZDI: ZDI-20-110 // ZDI: ZDI-20-108 // ZDI: ZDI-20-064 // ZDI: ZDI-20-025 // ZDI: ZDI-20-038 // ZDI: ZDI-20-085 // ZDI: ZDI-20-096 // ZDI: ZDI-20-099 // ZDI: ZDI-20-055 // VULHUB: VHN-148085

AFFECTED PRODUCTS

vendor:	cisco	model:	data center network manager	scope:	-	version:	-	Trust: 11.9
vendor:	cisco	model:	data center network manager	scope:	lt	version:	11.3\(1\)	Trust: 1.0

sources: ZDI: ZDI-20-110 // ZDI: ZDI-20-020 // ZDI: ZDI-20-099 // ZDI: ZDI-20-096 // ZDI: ZDI-20-085 // ZDI: ZDI-20-038 // ZDI: ZDI-20-025 // ZDI: ZDI-20-064 // ZDI: ZDI-20-108 // ZDI: ZDI-20-055 // ZDI: ZDI-20-022 // ZDI: ZDI-20-104 // ZDI: ZDI-20-042 // ZDI: ZDI-20-091 // ZDI: ZDI-20-115 // ZDI: ZDI-20-058 // ZDI: ZDI-20-074 // NVD: CVE-2019-15984

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI:	CVE-2019-15984
value:	HIGH
Trust: 10.5
ZDI:	CVE-2019-15984
value:	MEDIUM
Trust: 1.4
nvd@nist.gov:	CVE-2019-15984
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-15984
value:	HIGH
Trust: 1.0
VULHUB:	VHN-148085
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2019-15984
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
VULHUB:	VHN-148085
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

ZDI:	CVE-2019-15984
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 7.7
ZDI:	CVE-2019-15984
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.0
Trust: 1.4
ZDI:	CVE-2019-15984
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 1.4
nvd@nist.gov:	CVE-2019-15984
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.1
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-15984
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.0
Trust: 1.0
ZDI:	CVE-2019-15984
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.0
Trust: 0.7
ZDI:	CVE-2019-15984
baseSeverity:	MEDIUM
baseScore:	4.9
vectorString:	AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	1.2
impactScore:	3.6
version:	3.0
Trust: 0.7

PROBLEMTYPE DATA

problemtype:

CWE-89

Trust: 1.1

sources: VULHUB: VHN-148085 // NVD: CVE-2019-15984

PATCH

title:

Cisco has issued an update to correct this vulnerability.

url:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-sql-inject

Trust: 11.9

EXTERNAL IDS

db:	NVD	id:	CVE-2019-15984	Trust: 13.0
db:	PACKETSTORM	id:	156239	Trust: 1.1
db:	ZDI_CAN	id:	ZDI-CAN-9352	Trust: 0.7
db:	ZDI	id:	ZDI-20-110	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9043	Trust: 0.7
db:	ZDI	id:	ZDI-20-020	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9301	Trust: 0.7
db:	ZDI	id:	ZDI-20-099	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9283	Trust: 0.7
db:	ZDI	id:	ZDI-20-096	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9208	Trust: 0.7
db:	ZDI	id:	ZDI-20-085	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9182	Trust: 0.7
db:	ZDI	id:	ZDI-20-038	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9053	Trust: 0.7
db:	ZDI	id:	ZDI-20-025	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9169	Trust: 0.7
db:	ZDI	id:	ZDI-20-064	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9350	Trust: 0.7
db:	ZDI	id:	ZDI-20-108	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9134	Trust: 0.7
db:	ZDI	id:	ZDI-20-055	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9051	Trust: 0.7
db:	ZDI	id:	ZDI-20-022	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9342	Trust: 0.7
db:	ZDI	id:	ZDI-20-104	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9219	Trust: 0.7
db:	ZDI	id:	ZDI-20-042	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9217	Trust: 0.7
db:	ZDI	id:	ZDI-20-091	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9340	Trust: 0.7
db:	ZDI	id:	ZDI-20-115	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9124	Trust: 0.7
db:	ZDI	id:	ZDI-20-058	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9194	Trust: 0.7
db:	ZDI	id:	ZDI-20-074	Trust: 0.7
db:	CNNVD	id:	CNNVD-202001-038	Trust: 0.1
db:	VULHUB	id:	VHN-148085	Trust: 0.1

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20200102-dcnm-sql-inject	Trust: 13.0
url:	http://packetstormsecurity.com/files/156239/cisco-data-center-network-manager-11.2.1-sql-injection.html	Trust: 1.1

CREDITS

Steven Seeley (mr_me) of Source Incite

Trust: 11.9

SOURCES

db:	ZDI	id:	ZDI-20-110
db:	ZDI	id:	ZDI-20-020
db:	ZDI	id:	ZDI-20-099
db:	ZDI	id:	ZDI-20-096
db:	ZDI	id:	ZDI-20-085
db:	ZDI	id:	ZDI-20-038
db:	ZDI	id:	ZDI-20-025
db:	ZDI	id:	ZDI-20-064
db:	ZDI	id:	ZDI-20-108
db:	ZDI	id:	ZDI-20-055
db:	ZDI	id:	ZDI-20-022
db:	ZDI	id:	ZDI-20-104
db:	ZDI	id:	ZDI-20-042
db:	ZDI	id:	ZDI-20-091
db:	ZDI	id:	ZDI-20-115
db:	ZDI	id:	ZDI-20-058
db:	ZDI	id:	ZDI-20-074
db:	VULHUB	id:	VHN-148085
db:	NVD	id:	CVE-2019-15984

LAST UPDATE DATE

2025-02-15T22:49:49.375000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-20-110	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-020	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-099	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-096	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-085	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-038	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-025	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-064	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-108	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-055	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-022	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-104	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-042	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-091	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-115	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-058	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-074	date:	2020-01-03T00:00:00
db:	VULHUB	id:	VHN-148085	date:	2023-02-02T00:00:00
db:	NVD	id:	CVE-2019-15984	date:	2024-11-21T04:29:52.267

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-20-110	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-020	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-099	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-096	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-085	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-038	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-025	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-064	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-108	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-055	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-022	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-104	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-042	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-091	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-115	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-058	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-074	date:	2020-01-03T00:00:00
db:	VULHUB	id:	VHN-148085	date:	2020-01-06T00:00:00
db:	NVD	id:	CVE-2019-15984	date:	2020-01-06T08:15:11.440