CVE-2013-5486: OS Command Injection

Q: What is the severity of CVE-2013-5486?

CVE-2013-5486 is classified as a medium severity vulnerability.

Q: How do I fix CVE-2013-5486?

To mitigate CVE-2013-5486, upgrade Cisco Prime Data Center Network Manager to version 6.2(1) or later.

Q: What types of attacks can exploit CVE-2013-5486?

CVE-2013-5486 can be exploited by remote attackers to perform directory traversal attacks and write arbitrary files.

Q: Which Cisco Prime Data Center Network Manager versions are affected by CVE-2013-5486?

CVE-2013-5486 affects Cisco Prime Data Center Network Manager versions 4.1(2) through 6.1(1b).

Q: Is CVE-2013-5486 still a concern for users of Cisco Prime Data Center Network Manager?

Yes, users of affected versions should apply updates or mitigations to protect against CVE-2013-5486.

Published Sep 23, 2013

Updated

Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to write arbitrary files via the chartid parameter, aka Bug IDs CSCue77035 and CSCue77036. NOTE: this can be leveraged to execute arbitrary commands by using the JBoss autodeploy functionality.

Affected Software

19 affected components

cisco Prime Data Center Network Manager=4.1\(2\)

cisco Prime Data Center Network Manager=4.1\(3\)

cisco Prime Data Center Network Manager=4.1\(4\)

cisco Prime Data Center Network Manager=4.1\(5\)

cisco Prime Data Center Network Manager=4.2\(1\)

cisco Prime Data Center Network Manager=4.2\(3\)

cisco Prime Data Center Network Manager=5.0\(2\)

cisco Prime Data Center Network Manager=5.0\(3\)

cisco Prime Data Center Network Manager=5.1\(1\)

cisco Prime Data Center Network Manager=5.1\(2\)

cisco Prime Data Center Network Manager=5.1\(3u\)

cisco Prime Data Center Network Manager=5.2\(2\)

cisco Prime Data Center Network Manager=5.2\(2a\)

cisco Prime Data Center Network Manager=5.2\(2b\)

cisco Prime Data Center Network Manager=5.2\(2c\)

cisco Prime Data Center Network Manager=5.2\(2e\)

cisco Prime Data Center Network Manager=6.1\(1a\)

cisco Prime Data Center Network Manager=6.1\(1b\)

cisco Prime Data Center Network Manager<=6.1\(1b\)

Event History

Sep 23, 2013

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-5486?

CVE-2013-5486 is classified as a medium severity vulnerability.

How do I fix CVE-2013-5486?

To mitigate CVE-2013-5486, upgrade Cisco Prime Data Center Network Manager to version 6.2(1) or later.

What types of attacks can exploit CVE-2013-5486?

CVE-2013-5486 can be exploited by remote attackers to perform directory traversal attacks and write arbitrary files.

Which Cisco Prime Data Center Network Manager versions are affected by CVE-2013-5486?

CVE-2013-5486 affects Cisco Prime Data Center Network Manager versions 4.1(2) through 6.1(1b).

Is CVE-2013-5486 still a concern for users of Cisco Prime Data Center Network Manager?