Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities (Cisco Cisco Prime Infrastructure)

CVE-2019-1822
HIGH 8.8

En bref

Source
NVD
EPSS
EPSS 4.42 % · centile 91 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
cisco
Statut NVD
Modified

Description

A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.

Faiblesses (CWE)

  • CWE-20 — Validation d'entrée incorrecte

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.0HIGH 8.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hcisco
CVSS 3.1HIGH 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)
CVSS 3.0HIGH 8.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · psirt@cisco.com (Secondary)
CVSS 2.0HIGH 9.0AV:N/AC:L/Au:S/C:C/I:C/A:CNVD · nvd@nist.gov (Primary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Cisco · Cisco Prime Infrastructureaffected 3.4

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD