cisco-sa-20180905-nfvis-infodis: Cisco Enterprise NFV Infrastructure Software Information Disclosure Vulnerability
A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read any file on an affected system. The vulnerability is due to insufficient authorization and parameter validation checks. An attacker could exploit this vulnerability by sending a malicious API request with the authentication credentials of a low-privileged user. A successful exploit could allow the attacker to read any file on the affected system.
There are no workarounds that address this vulnerability.
This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-nfvis-infodis
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-20180905-nfvis-infodis?
The severity of cisco-sa-20180905-nfvis-infodis is classified as high due to the potential for an authenticated remote attacker to read sensitive files.
How do I fix cisco-sa-20180905-nfvis-infodis?
To fix cisco-sa-20180905-nfvis-infodis, it is recommended to apply any available patches from Cisco for the affected software.
What systems are affected by cisco-sa-20180905-nfvis-infodis?
Cisco Enterprise NFV Infrastructure Software is the affected system for cisco-sa-20180905-nfvis-infodis.
What is the cause of cisco-sa-20180905-nfvis-infodis?
The cause of cisco-sa-20180905-nfvis-infodis is insufficient authorization and parameter validation checks in the REST API.
Can cisco-sa-20180905-nfvis-infodis be exploited remotely?
Yes, cisco-sa-20180905-nfvis-infodis can be exploited remotely by an authenticated attacker.