Cisco Enterprise NFV Infrastructure Software Web Portal os command injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in Cisco Enterprise NFV Infrastructure Software. This issue affects some unknown processing of the component Web Portal. This manipulation causes os command injection. This vulnerability appears as CVE-2019-1971. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Cisco Enterprise NFV Infrastructure Software (affected version unknown) and classified as critical. Affected by this vulnerability is an unknown functionality of the component Web Portal. The manipulation with an unknown input leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform a command injection attack and execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation by the web portal framework. An attacker could exploit this vulnerability by providing malicious input during web portal authentication. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system.

The weakness was presented 08/08/2019 as cisco-sa-20190807-nfv-commandi as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is known as CVE-2019-1971 since 12/06/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

Upgrading eliminates this vulnerability.

See VDB-139695, VDB-139694, VDB-139691 and VDB-139690 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Cisco

Name

• Enterprise NFV Infrastructure Software

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion