Lucene search

K
cve[email protected]CVE-2019-1981
HistoryNov 05, 2019 - 8:15 p.m.

CVE-2019-1981

2019-11-0520:15:11
CWE-20
CWE-264
web.nvd.nist.gov
27
cisco
firepower
threat defense
software
vulnerability
bypass
filtering
remote attacker
nvd

5.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

5.7 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

47.9%

A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due to insufficient normalization of a text-based payload. An attacker could exploit this vulnerability by sending traffic that contains specifically obfuscated payloads through an affected device. An exploit could allow the attacker to bypass filtering and deliver malicious payloads to protected systems that would otherwise be blocked.

Affected configurations

NVD
Node
ciscofirepower_management_centerRange2.9.122.9.12.15
OR
ciscofirepower_management_centerRange2.9.132.9.13.6
OR
ciscofirepower_management_centerRange2.9.14.02.9.14.5
OR
ciscofirepower_management_centerMatch2.9.15
OR
ciscofirepower_management_centerMatch2.9.16
OR
ciscofirepower_services_software_for_asa
OR
ciscofirepower_threat_defense

CNA Affected

[
  {
    "product": "Cisco Firepower Threat Defense Software ",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "n/a",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

5.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

5.7 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

47.9%

Related for CVE-2019-1981