CVE-2019-1953: Cisco Enterprise NFV Infrastructure Software Password Recovery Vulnerability
A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when logging in to the web portal for the first time. Subsequent password changes are not logged and other accounts are not affected. An attacker could exploit this vulnerability by viewing the admin clear text password and using it to access the affected system. The attacker would need a valid user account to exploit this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1953?
CVE-2019-1953 has a high severity rating, allowing authenticated attackers to expose sensitive information.
How do I fix CVE-2019-1953?
To fix CVE-2019-1953, upgrade to Cisco Enterprise NFV Infrastructure Software version 3.9.1 or later.
Who is affected by CVE-2019-1953?
Cisco Enterprise Network Functions Virtualization Infrastructure Software versions prior to 3.9.1 are affected by CVE-2019-1953.
What types of attackers can exploit CVE-2019-1953?
Authenticated remote attackers can exploit CVE-2019-1953 to view passwords in clear text.
What is the impact of CVE-2019-1953?
The impact of CVE-2019-1953 is that it can lead to unauthorized exposure of admin passwords.