cisco-sa-20190417-swim-proxy: Cisco DNA Center Unintended Proxy Via SWIM Import Interface Vulnerability
A vulnerability in the Software Image Management feature of Cisco DNA Center could allow an authenticated, remote attacker to access to internal services without additional authentication. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending arbitrary HTTP requests to internal services. An exploit could allow the attacker to bypass any firewall or other protections to access unauthorized internal services.
There are no workarounds that address this vulnerability.
This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-swim-proxy
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-20190417-swim-proxy?
The severity of cisco-sa-20190417-swim-proxy is categorized as high due to its potential to allow unauthorized access to internal services.
How do I fix cisco-sa-20190417-swim-proxy?
To fix cisco-sa-20190417-swim-proxy, update your Cisco DNA Center to the latest version provided by Cisco.
Who is affected by cisco-sa-20190417-swim-proxy?
The cisco-sa-20190417-swim-proxy vulnerability affects all versions of Cisco DNA Center Software.
What are the potential impacts of cisco-sa-20190417-swim-proxy?
The potential impacts of cisco-sa-20190417-swim-proxy include unauthorized access to sensitive internal services.
Is authentication required to exploit cisco-sa-20190417-swim-proxy?
Yes, authentication is required for an attacker to exploit the cisco-sa-20190417-swim-proxy vulnerability.