cisco-sa-20190807-nfv-fileread: Cisco Enterprise NFV Infrastructure Software Web Portal Arbitrary File Read Vulnerability
A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerability is due to the improper input validation of tar packages uploaded through the Web Portal to the Image Repository. An attacker could exploit this vulnerability by uploading a crafted tar package and viewing the log entries that are generated. A successful exploit could allow the attacker to read arbitrary files on the underlying OS. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-fileread
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-20190807-nfv-fileread?
The severity of cisco-sa-20190807-nfv-fileread is considered high due to the potential for unauthorized file access on the operating system.
How do I fix cisco-sa-20190807-nfv-fileread?
To fix cisco-sa-20190807-nfv-fileread, apply the recommended software updates provided by Cisco for the affected NFV Infrastructure Software.
Who is affected by cisco-sa-20190807-nfv-fileread?
Organisations using Cisco Enterprise NFV Infrastructure Software are affected by cisco-sa-20190807-nfv-fileread.
What type of vulnerability is cisco-sa-20190807-nfv-fileread?
cisco-sa-20190807-nfv-fileread is an input validation vulnerability that allows reading arbitrary files on the underlying operating system.
Can cisco-sa-20190807-nfv-fileread be exploited remotely?
Yes, cisco-sa-20190807-nfv-fileread can be exploited by an authenticated remote attacker.