CVE-2019-1961: Cisco Enterprise NFV Infrastructure Software Web Portal Arbitrary File Read Vulnerability
A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerability is due to the improper input validation of tar packages uploaded through the Web Portal to the Image Repository. An attacker could exploit this vulnerability by uploading a crafted tar package and viewing the log entries that are generated. A successful exploit could allow the attacker to read arbitrary files on the underlying OS.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1961?
CVE-2019-1961 has been rated as a high severity vulnerability.
How do I fix CVE-2019-1961?
To fix CVE-2019-1961, upgrade Cisco Enterprise NFV Infrastructure Software to version 3.10.1 or later.
What causes the vulnerability CVE-2019-1961?
CVE-2019-1961 is caused by improper input validation of tar packages uploaded to the system.
What type of attacker can exploit CVE-2019-1961?
An authenticated remote attacker can exploit CVE-2019-1961 to read arbitrary files on the underlying operating system.
What systems are affected by CVE-2019-1961?
CVE-2019-1961 affects Cisco Enterprise Network Functions Virtualization Infrastructure Software versions prior to 3.10.1.