Lucene search

[email protected]CVE-2019-1734

HistoryNov 05, 2019 - 8:15 p.m.

CVE-2019-1734

2019-11-0520:15:11

CWE-200

[email protected]

web.nvd.nist.gov

cisco

fxos

nx-os

vulnerability

cli

authentication

local attacker

sensitive information

rbac

exploit

nvd

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

5.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

A vulnerability in the implementation of a CLI diagnostic command in Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to view sensitive system files that should be restricted. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to incomplete role-based access control (RBAC) verification. An attacker could exploit this vulnerability by authenticating to the device and issuing a specific CLI diagnostic command with crafted user-input parameters. An exploit could allow the attacker to perform an arbitrary read of a file on the device, and the file may contain sensitive information. The attacker needs valid device credentials to exploit this vulnerability.

Affected configurations

NVD

Node

ciscofirepower_extensible_operating_systemRange<2.2.2.91

ciscofirepower_extensible_operating_systemRange2.3–2.3.1.111

ciscofirepower_extensible_operating_systemRange2.4–2.4.1.101

AND

ciscofirepower_4110Match-

ciscofirepower_4112Match-

ciscofirepower_4115Match-

ciscofirepower_4120Match-

ciscofirepower_4125Match-

ciscofirepower_4140Match-

ciscofirepower_4145Match-

ciscofirepower_4150Match-

ciscofirepower_9300Match-

Node

cisconx-osRange<6.2\(7\)

AND

ciscomds_9100Match-

ciscomds_9200Match-

ciscomds_9500Match-

ciscomds_9700Match-

Node

cisconx-osRange<7.0\(3\)i4\(9\)

cisconx-osRange7.0\(3\)i7–7.0\(3\)i7\(6\)

AND

cisconexus_3016Match-

cisconexus_3048Match-

cisconexus_3064Match-

cisconexus_3064-tMatch-

cisconexus_31108pc-vMatch-

cisconexus_31108tc-vMatch-

cisconexus_31128pqMatch-

cisconexus_3132c-zMatch-

cisconexus_3132qMatch-

cisconexus_3132q-vMatch-

cisconexus_3132q-xlMatch-

cisconexus_3164qMatch-

cisconexus_3172Match-

cisconexus_3172pq-xlMatch-

cisconexus_3172tqMatch-

cisconexus_3172tq-32tMatch-

cisconexus_3172tq-xlMatch-

cisconexus_3232cMatch-

cisconexus_3264c-eMatch-

cisconexus_3264qMatch-

cisconexus_3408-sMatch-

cisconexus_34180ycMatch-

cisconexus_3432d-sMatch-

cisconexus_3464cMatch-

cisconexus_9000vMatch-

cisconexus_92160yc-xMatch-

cisconexus_92300ycMatch-

cisconexus_92304qcMatch-

cisconexus_92348gc-xMatch-

cisconexus_9236cMatch-

cisconexus_9272qMatch-

cisconexus_93108tc-exMatch-

cisconexus_93108tc-fxMatch-

cisconexus_93120txMatch-

cisconexus_93128txMatch-

cisconexus_93180lc-exMatch-

cisconexus_93180yc-exMatch-

cisconexus_93180yc-fxMatch-

cisconexus_93216tc-fx2Match-

cisconexus_93240yc-fx2Match-

cisconexus_9332cMatch-

cisconexus_9332pqMatch-

cisconexus_93360yc-fx2Match-

cisconexus_9336c-fx2Match-

cisconexus_9336pq_aci_spineMatch-

cisconexus_9348gc-fxpMatch-

cisconexus_9364cMatch-

cisconexus_9372pxMatch-

cisconexus_9372px-eMatch-

cisconexus_9372txMatch-

cisconexus_9372tx-eMatch-

cisconexus_9396pxMatch-

cisconexus_9396txMatch-

Node

cisconx-osRange<6.0\(2\)a4\(1\)

cisconx-osRange7.0\(3\)i4–7.0\(3\)i4\(9\)

cisconx-osRange7.0\(3\)i7–7.0\(3\)i7\(6\)

AND

cisconexus_3524Match-

cisconexus_3524-xMatch-

cisconexus_3524-xlMatch-

cisconexus_3548Match-

cisconexus_3548-xMatch-

cisconexus_3548-xlMatch-

Node

cisconx-osRange7.0\(3\)–7.0\(3\)f3\(5\)

AND

cisconexus_36180yc-rMatch-

cisconexus_3636c-rMatch-

cisconexus_9504Match-

cisconexus_9508Match-

cisconexus_9516Match-

Node

cisconx-osRange<7.1\(4\)n1\(1\)

cisconx-osRange7.2–7.3\(0\)n1\(1\)

AND

cisconexus_5548pMatch-

cisconexus_5548upMatch-

cisconexus_5596tMatch-

cisconexus_5596upMatch-

cisconexus_56128pMatch-

cisconexus_5624qMatch-

cisconexus_5648qMatch-

cisconexus_5672upMatch-

cisconexus_5696qMatch-

cisconexus_6001Match-

cisconexus_6004Match-

Node

cisconx-osRange<6.2\(6\)

AND

cisconexus_7000Match-

cisconexus_7700Match-

Node

cisconx-osRange<4.0\(1a\)

AND

ciscoucs_6200Match-

ciscoucs_6300Match-

CPENameOperatorVersion
cisco:firepower_extensible_operating_systemcisco firepower extensible operating systemlt2.2.2.91
cisco:firepower_extensible_operating_systemcisco firepower extensible operating systemlt2.3.1.111
cisco:firepower_extensible_operating_systemcisco firepower extensible operating systemlt2.4.1.101

CPE	Name	Operator	Version
cisco:firepower_extensible_operating_system	cisco firepower extensible operating system	lt	2.2.2.91
cisco:firepower_extensible_operating_system	cisco firepower extensible operating system	lt	2.3.1.111
cisco:firepower_extensible_operating_system	cisco firepower extensible operating system	lt	2.4.1.101

CNA Affected

[
  {
    "product": "Cisco NX-OS Software ",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "6.2(7)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-fxos-info

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

5.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2019-1734

nvd1 nessus3 cvelist1 cisco1 prion1