CVE-2019-1794: Cisco Directory Connector Search Order Hijacking Vulnerability

Published Apr 18, 2019

Updated

A vulnerability in the search path processing of Cisco Directory Connector could allow an authenticated, local attacker to load a binary of their choosing. The vulnerability is due to uncontrolled search path elements. An attacker could exploit this vulnerability by placing a binary of their choosing earlier in the search path utilized by Cisco Directory Connector to locate and load required resources.

Affected Software

1 affected component

Cisco Meeting Server=2.2

Event History

Apr 18, 2019

CVE Published

via MITRE·12:35 AM

Data Sourced

via MITRE·12:35 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:29 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2019-1794?

CVE-2019-1794 is a vulnerability in the search path processing of Cisco Directory Connector that could allow an authenticated, local attacker to load a binary of their choosing.

How does CVE-2019-1794 occur?

CVE-2019-1794 occurs due to uncontrolled search path elements in Cisco Directory Connector.

What is the severity of CVE-2019-1794?

The severity of CVE-2019-1794 is medium (CVSS score 5.1).

Which software is affected by CVE-2019-1794?

Cisco Meeting Server version 2.2 is affected by CVE-2019-1794.

How can CVE-2019-1794 be exploited?

An attacker can exploit CVE-2019-1794 by placing a binary of their choosing.