{"id": "CISCO-SA-WEBUI-FILERD-HNGNDYGK", "type": "cisco", "bulletinFamily": "software", "title": "Cisco IOS XE Software Web UI Arbitrary File Read Vulnerability", "description": "A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to read arbitrary files on the underlying filesystem of the device.\n\nThe vulnerability is due to insufficient file scope limiting. An attacker could exploit this vulnerability by creating a specific file reference on the filesystem and then accessing it through the web UI. An exploit could allow the attacker to read arbitrary files from the underlying operating system's filesystem.\n\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\n\nThis advisory is available at the following link:\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-filerd-HngnDYGk [\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-filerd-HngnDYGk\"]", "published": "2020-06-03T16:00:00", "modified": "2020-06-03T16:00:00", "cvss": {"score": 4.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N"}, "href": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-filerd-HngnDYGk", "reporter": "Cisco", "references": ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-filerd-HngnDYGk"], "cvelist": ["CVE-2020-3223"], "lastseen": "2020-12-24T11:40:31", "viewCount": 3, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-3223"]}, {"type": "nessus", "idList": ["CISCO-SA-WEBUI-FILERD-HNGNDYGK-IOSXE.NASL"]}, {"type": "cisco", "idList": ["CISCO-SA-WEBUI-FILERD-HNGNDYGK"]}], "modified": "2020-12-24T11:40:31", "rev": 2}, "score": {"value": 6.6, "vector": "NONE", "modified": "2020-12-24T11:40:31", "rev": 2}, "vulnersScore": 6.6}, "affectedSoftware": [{"version": "16.9", "operator": "eq", "name": "cisco ios xe software"}, {"version": "16.11", "operator": "eq", "name": "cisco ios xe software"}, {"version": "16.12", "operator": "eq", "name": "cisco ios xe software"}, {"version": "16.9.4", "operator": "eq", "name": "cisco ios xe software"}, {"version": "16.9.4c", "operator": "eq", "name": "cisco ios xe software"}, {"version": "16.11.1", "operator": "eq", "name": "cisco ios xe software"}, {"version": "16.11.1a", "operator": "eq", "name": "cisco ios xe software"}, {"version": "16.11.1b", "operator": "eq", "name": "cisco ios xe software"}, {"version": "16.11.2", "operator": "eq", "name": "cisco ios xe software"}, {"version": "16.11.1s", "operator": "eq", "name": "cisco ios xe software"}, {"version": "16.11.1c", "operator": "eq", "name": "cisco ios xe software"}, {"version": "16.12.1", "operator": "eq", "name": "cisco ios xe software"}, {"version": "16.12.1s", "operator": "eq", "name": "cisco ios xe software"}, {"version": "16.12.1a", "operator": "eq", "name": "cisco ios xe software"}, {"version": "16.12.1c", "operator": "eq", "name": "cisco ios xe software"}, {"version": "16.12.1w", "operator": "eq", "name": "cisco ios xe software"}, {"version": "16.12.1y", "operator": "eq", "name": "cisco ios xe software"}, {"version": "16.12.1t", "operator": "eq", "name": "cisco ios xe software"}]}

{"cve": [{"lastseen": "2020-10-03T12:55:54", "description": "A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to read arbitrary files on the underlying filesystem of the device. The vulnerability is due to insufficient file scope limiting. An attacker could exploit this vulnerability by creating a specific file reference on the filesystem and then accessing it through the web UI. An exploit could allow the attacker to read arbitrary files from the underlying operating system's filesystem.", "edition": 4, "cvss3": {"exploitabilityScore": 1.2, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.9, "privilegesRequired": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2020-06-03T18:15:00", "title": "CVE-2020-3223", "type": "cve", "cwe": ["CWE-59"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 6.8, "vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-3223"], "modified": "2020-06-09T17:42:00", "cpe": ["cpe:/o:cisco:ios_xe:16.11.1", "cpe:/o:cisco:ios_xe:16.12.1y", "cpe:/o:cisco:ios_xe:16.11.1s", "cpe:/o:cisco:ios_xe:16.9.4", "cpe:/o:cisco:ios_xe:16.11.2", "cpe:/o:cisco:ios_xe:16.12.1t", "cpe:/o:cisco:ios_xe:16.12.1w", "cpe:/o:cisco:ios_xe:16.11.1a", "cpe:/o:cisco:ios_xe:16.12.1a", "cpe:/o:cisco:ios_xe:16.9.4c", "cpe:/o:cisco:ios_xe:16.12.1c", "cpe:/o:cisco:ios_xe:16.12.1s", "cpe:/o:cisco:ios_xe:16.11.1c", "cpe:/o:cisco:ios_xe:16.11.1b", "cpe:/o:cisco:ios_xe:16.12.1"], "id": "CVE-2020-3223", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-3223", "cvss": {"score": 6.8, "vector": "AV:N/AC:L/Au:S/C:C/I:N/A:N"}, "cpe23": ["cpe:2.3:o:cisco:ios_xe:16.11.1b:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:16.9.4c:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:16.11.2:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:16.9.4:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:16.12.1t:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:16.12.1s:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:16.12.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:16.11.1c:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:16.11.1s:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:16.11.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:16.12.1y:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:16.12.1:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:16.11.1a:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:16.12.1w:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:ios_xe:16.12.1c:*:*:*:*:*:*:*"]}], "nessus": [{"lastseen": "2021-01-09T01:35:33", "description": "According to its self-reported version, Cisco IOS XE Software is affected by an arbitrary file read vulnerability.\nPlease see the included Cisco BID and Cisco Security Advisory for more information.", "edition": 4, "cvss3": {"score": 4.9, "vector": "AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}, "published": "2020-07-16T00:00:00", "title": "Cisco IOS XE Software Web UI Arbitrary File Read Vulnerability (cisco-sa-webui-filerd-HngnDYGk)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-3223"], "modified": "2020-07-16T00:00:00", "cpe": ["cpe:/o:cisco:ios_xe"], "id": "CISCO-SA-WEBUI-FILERD-HNGNDYGK-IOSXE.NASL", "href": "https://www.tenable.com/plugins/nessus/138524", "sourceData": "#TRUSTED 41ef0e311c5e7a1350f6637f16429e30a15f275386285a2e1c01ebc4486d573f5f0d4dd6d1fa5c19514f4f21caf6d581ba9f423eb51ccd1eb046c484b01733d1db8388e5c64a3307a7497bf37e85f343771b8f2ce16ec08928a6281f27c76f786f71bf5c14da78ea2ed10927e80e50350f1e64a804cba8cb16e13994202bf26c7ee8fccf94738556a998601e7a32f331e49f69cb8c91f21fec6035bb7f246142c9b3856bf97b03f97b4c9d91d46e282adc79a24567e23bd87abf769f289d88c955a131b5b0b4be3f77ed4b8749423adc65750e24b559459e42e96500b16d5479aa21841c0c108e8e28d607c3fe1f5690cc301941525dbc6f220b3e2118ce923723a584eee44de5e67d026717d2191a79329ea1ffd3cdd7051b0b360d75692ad62ea6e61530eb449b599149e0407df5b7fe7aa015f46d1e19402d8db83b09467105c25615bfc418dd4579b054508e4d064c6453148624491e66d3f42f8c848052bb306c5846b601137b26f6dbb37cd0e84b2703283a9839b885dc62b776927e1cb82d40919424c25a7b7f3ed7d1d6b3709846a6049758cf219e8047089f11a8143a2935946f997cb4745046274f0775b6f06aff1ce8660d2b99369cb33076f5b88635999a60957d8965bb43a1b010acbf8eb7d1aaebc408c94788750c42782b74dcf3d7981eaf06f80c03ec41b103254a4c2c44134e455a3cb929dfa4e342ba00\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(138524);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/08\");\n\n script_cve_id(\"CVE-2020-3223\");\n script_xref(name:\"CISCO-BUG-ID\", value:\"CSCvq90852\");\n script_xref(name:\"CISCO-SA\", value:\"cisco-sa-webui-filerd-HngnDYGk\");\n script_xref(name:\"IAVA\", value:\"2020-A-0239\");\n\n script_name(english:\"Cisco IOS XE Software Web UI Arbitrary File Read Vulnerability (cisco-sa-webui-filerd-HngnDYGk)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote device is missing a vendor-supplied security patch.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its self-reported version, Cisco IOS XE Software is affected by an arbitrary file read vulnerability.\nPlease see the included Cisco BID and Cisco Security Advisory for more information.\");\n # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-filerd-HngnDYGk\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?bc271b65\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvq90852\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvq90852\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-3223\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_cwe_id(59);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/06/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/06/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/07/16\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:cisco:ios_xe\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CISCO\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"cisco_ios_xe_version.nasl\");\n script_require_keys(\"Host/Cisco/IOS-XE/Version\");\n\n exit(0);\n}\n\ninclude('cisco_workarounds.inc');\ninclude('ccf.inc');\n\nproduct_info = cisco::get_product_info(name:'Cisco IOS XE Software');\n\nvuln_versions = make_list(\n '16.9.4',\n '16.9.4c',\n '16.11.1',\n '16.11.1a',\n '16.11.1b',\n '16.11.1c',\n '16.11.1s',\n '16.11.2',\n '16.12.1',\n '16.12.1a',\n '16.12.1c',\n '16.12.1s',\n '16.12.1t',\n '16.12.1w',\n '16.12.1y'\n);\n\nworkarounds = make_list(CISCO_WORKAROUNDS['HTTP_Server_iosxe']);\nworkaround_params = {'no_active_sessions' : 1};\n\nreporting = make_array(\n 'port' , product_info['port'], \n 'severity' , SECURITY_WARNING,\n 'version' , product_info['version'],\n 'cmds' , make_list('show running-config'),\n 'bug_id' , 'CSCvq90852',\n 'disable_caveat', TRUE\n);\n\ncisco::check_and_report(\n product_info:product_info,\n workarounds:workarounds,\n workaround_params:workaround_params,\n reporting:reporting,\n vuln_versions:vuln_versions\n);\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:L/Au:S/C:C/I:N/A:N"}}]}