A vulnerability classified as problematic was found in Cisco Enterprise NFV Infrastructure Software (unknown version). This vulnerability affects an unknown code block. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality. CVE summarizes:

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the underlying operating system (OS) of an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

The weakness was published 08/08/2019 as cisco-sa-20190807-nfv-read as confirmed advisory (Website). The advisory is available at tools.cisco.com. This vulnerability was named CVE-2019-1960 since 12/06/2018. Local access is required to approach this attack. The requirement for exploitation is a single authentication. The technical details are unknown and an exploit is not available.

Upgrading eliminates this vulnerability.

Similar entry is available at VDB-139689. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Cisco

Name

• Enterprise NFV Infrastructure Software

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion