CVE-2019-1854: Path Traversal
First published: Fri May 03 2019(Updated: )
A vulnerability in the management web interface of Cisco Expressway Series could allow an authenticated, remote attacker to perform a directory traversal attack against an affected device. The vulnerability is due to insufficient input validation on the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web interface. A successful exploit could allow the attacker to bypass security restrictions and access the web interface of a Cisco Unified Communications Manager associated with the affected device. Valid credentials would still be required to access the Cisco Unified Communications Manager interface.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco TelePresence Video Communication Server | =x8.11.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/152963/Cisco-Expressway-Gateway-11.5.1-Directory-Traversal.html
- http://seclists.org/fulldisclosure/2019/May/28
- http://www.securityfocus.com/bid/108154
- https://seclists.org/bugtraq/2019/May/49
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-expressway-traversal
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2019-1854.
What is the severity of CVE-2019-1854?
The severity of CVE-2019-1854 is medium with a severity value of 4.3.
What software versions are affected by CVE-2019-1854?
Cisco TelePresence Video Communication Server version x8.11.4 is affected by CVE-2019-1854.
What is the CWE number for CVE-2019-1854?
The CWE number for CVE-2019-1854 is CWE-20 and CWE-22.
How can an attacker exploit CVE-2019-1854?
An attacker can exploit CVE-2019-1854 by performing a directory traversal attack against an affected device through the management web interface.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- vendor/cisco
- canonical/cisco telepresence video communication server
- version/cisco telepresence video communication server/x8.11.4