Cisco FirePOWER Management Center Web-based Management Interface HTTP Request path traversal

Summaryinfo

A vulnerability marked as critical has been reported in Cisco FirePOWER Management Center. The impacted element is an unknown function of the component Web-based Management Interface. The manipulation as part of HTTP Request leads to path traversal. This vulnerability is listed as CVE-2019-12691. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco FirePOWER Management Center (Firewall Software) (the affected version is unknown) and classified as critical. This issue affects an unknown code of the component Web-based Management Interface. The manipulation as part of a HTTP Request leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack on an affected device. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface. A successful exploit could allow the attacker to bypass Cisco FMC Software security restrictions and gain access to the underlying filesystem of the affected device.

The weakness was presented 10/02/2019 as cisco-sa-20191002-fmc-dir-trav as confirmed advisory (Website). The advisory is shared at tools.cisco.com. The identification of this vulnerability is CVE-2019-12691 since 06/04/2019. The attack may be initiated remotely. A simple authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading eliminates this vulnerability.

See VDB-142852, VDB-142851, VDB-142850 and VDB-142849 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• FirePOWER Management Center

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion