Lucene search

CiscoCVE-2019-12623

HistoryAug 21, 2019 - 6:15 p.m.

CVE-2019-12623

2019-08-2118:15:13

CWE-538

cisco

web.nvd.nist.gov

cisco

nfvis

web server

vulnerability

file enumeration

cve-2019-12623

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

31.7%

JSON

A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform file enumeration on an affected system. The vulnerability is due to the web server responding with different error codes for existing and non-existing files. An attacker could exploit this vulnerability by sending GET requests for different file names. A successful exploit could allow the attacker to enumerate files residing on the system.

Affected configurations

Nvd

Vulners

Node

ciscoenterprise_network_functions_virtualization_infrastructureRange<3.12.1

VendorProductVersionCPE
ciscoenterprise_network_functions_virtualization_infrastructure*cpe:2.3:a:cisco:enterprise_network_functions_virtualization_infrastructure:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	enterprise_network_functions_virtualization_infrastructure	*	cpe:2.3:a:cisco:enterprise_network_functions_virtualization_infrastructure::::::::

CNA Affected

[
  {
    "product": "Cisco Enterprise NFV Infrastructure Software",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "3.12.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-nfv-enumeration

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

31.7%

JSON

Related for CVE-2019-12623