Lucene search

CiscoCVELIST:CVE-2019-1743

HistoryMar 27, 2019 - 11:35 p.m.

CVE-2019-1743 Cisco IOS XE Software Arbitrary File Upload Vulnerability

2019-03-2723:35:36

CWE-20

cisco

www.cve.org

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.4

Confidence

High

EPSS

0.004

Percentile

73.1%

JSON

A vulnerability in the web UI framework of Cisco IOS XE Software could allow an authenticated, remote attacker to make unauthorized changes to the filesystem of the affected device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by crafting a malicious file and uploading it to the device. An exploit could allow the attacker to gain elevated privileges on the affected device.

CNA Affected

[
  {
    "product": "Cisco IOS XE Software",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "16.2.1"
      },
      {
        "status": "affected",
        "version": "16.2.2"
      },
      {
        "status": "affected",
        "version": "16.3.1"
      },
      {
        "status": "affected",
        "version": "16.3.2"
      },
      {
        "status": "affected",
        "version": "16.3.3"
      },
      {
        "status": "affected",
        "version": "16.3.1a"
      },
      {
        "status": "affected",
        "version": "16.3.4"
      },
      {
        "status": "affected",
        "version": "16.3.5"
      },
      {
        "status": "affected",
        "version": "16.3.5b"
      },
      {
        "status": "affected",
        "version": "16.3.6"
      },
      {
        "status": "affected",
        "version": "16.4.1"
      },
      {
        "status": "affected",
        "version": "16.4.2"
      },
      {
        "status": "affected",
        "version": "16.4.3"
      },
      {
        "status": "affected",
        "version": "16.5.1"
      },
      {
        "status": "affected",
        "version": "16.5.1a"
      },
      {
        "status": "affected",
        "version": "16.5.1b"
      },
      {
        "status": "affected",
        "version": "16.5.2"
      },
      {
        "status": "affected",
        "version": "16.5.3"
      },
      {
        "status": "affected",
        "version": "16.6.1"
      },
      {
        "status": "affected",
        "version": "16.6.2"
      },
      {
        "status": "affected",
        "version": "16.6.3"
      },
      {
        "status": "affected",
        "version": "16.7.1"
      },
      {
        "status": "affected",
        "version": "16.7.1a"
      },
      {
        "status": "affected",
        "version": "16.7.1b"
      },
      {
        "status": "affected",
        "version": "16.8.1"
      },
      {
        "status": "affected",
        "version": "16.8.1a"
      },
      {
        "status": "affected",
        "version": "16.8.1b"
      },
      {
        "status": "affected",
        "version": "16.8.1s"
      },
      {
        "status": "affected",
        "version": "16.8.1c"
      },
      {
        "status": "affected",
        "version": "16.8.1d"
      },
      {
        "status": "affected",
        "version": "16.8.1e"
      }
    ]
  }
]

References

www.securityfocus.com/bid/107591

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-afu

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.4

Confidence

High

EPSS

0.004

Percentile

73.1%

JSON

Related for CVELIST:CVE-2019-1743