cisco-sa-20190417-swim-proxy: Cisco DNA Center Unintended Proxy Via SWIM Import Interface Vulnerability
First published: Wed Apr 17 2019(Updated: )
A vulnerability in the Software Image Management feature of Cisco DNA Center could allow an authenticated, remote attacker to access to internal services without additional authentication. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending arbitrary HTTP requests to internal services. An exploit could allow the attacker to bypass any firewall or other protections to access unauthorized internal services. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-swim-proxy
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco DNA Center Software |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20190417-swim-proxy?
The severity of cisco-sa-20190417-swim-proxy is categorized as high due to its potential to allow unauthorized access to internal services.
How do I fix cisco-sa-20190417-swim-proxy?
To fix cisco-sa-20190417-swim-proxy, update your Cisco DNA Center to the latest version provided by Cisco.
Who is affected by cisco-sa-20190417-swim-proxy?
The cisco-sa-20190417-swim-proxy vulnerability affects all versions of Cisco DNA Center Software.
What are the potential impacts of cisco-sa-20190417-swim-proxy?
The potential impacts of cisco-sa-20190417-swim-proxy include unauthorized access to sensitive internal services.
Is authentication required to exploit cisco-sa-20190417-swim-proxy?
Yes, authentication is required for an attacker to exploit the cisco-sa-20190417-swim-proxy vulnerability.
- agent/type
- agent/event
- agent/last-modified-date
- collector/cisco-advisory
- source/Cisco
- agent/title
- agent/severity
- agent/weakness
- agent/references
- agent/description
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco dna center software