CVE-2019-1820

🗓️ 16 May 2019 01:10:45Reported by ciscoType

cve🔗 web.nvd.nist.gov👁 72 Views🌐 WEB

Cisco Prime Infrastructure and Cisco EPN Manager web interface allows unauthorized file acces

Reporter	Title	Published	Views	Family All 9
BDU FSTEC	The vulnerability in the web interface of the Cisco Prime Infrastructure monitoring and network device management system, as well as the Cisco Evolved Programmable Network (EPN) Manager software, relates to errors in handling HTTP requests. This vulnerability allows an attacker to gain access to protected information.	21 Jun 201900:00	–	bdu_fstec
Cisco	Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability	15 May 201916:00	–	cisco
Cvelist	CVE-2019-1820 Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability	16 May 201901:10	–	cvelist
NVD	CVE-2019-1820	16 May 201901:29	–	nvd
OSV	CVE-2019-1820	16 May 201901:29	–	osv
Prion	Directory traversal	16 May 201901:29	–	prion
Positive Technologies	PT-2019-2411 · Cisco · Cisco Evolved Programmable Network (Epn) Manager +1	15 May 201900:00	–	ptsecurity
Source Incite	SRC-2019-0037 : Cisco Prime Infrastructure XmpMultiPathDownloadServlet Directory Traversal Information Disclosure Vulnerability	1 Feb 201900:00	–	srcincite
Vulnrichment	CVE-2019-1820 Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability	16 May 201901:10	–	vulnrichment

NVD

Node

cisco evolved_programmable_network_managerRange<3.0.1

cisco prime_infrastructureRange<3.4

[
  {
    "product": "Cisco Prime Infrastructure",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "3.4"
      }
    ]
  }
]

Source	Link
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-pathtrav-1820
securityfocus	www.securityfocus.com/bid/108345

Parameter	Position	Path	Description	CWE
filename	query param	/XmpMultiPathDownloadServlet	Authenticated remote attacker can use directory traversal via filename/path parameters to disclose files in the application.	CWE-22
path	query param	/XmpMultiPathDownloadServlet	Authenticated remote attacker can use directory traversal via filename/path parameters to disclose files in the application.	CWE-22

17 Jun 2026 02:29Current

6.3Medium risk

Vulners AI Score6.3

CVSS 24

CVSS 3.16.5

CVSS 36.5

EPSS0.13856

SSVC

CWE-22