cisco-sa-20191002-fmc-dir-trav: Cisco Firepower Management Center Directory Traversal Vulnerability
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack on an affected device. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface. A successful exploit could allow the attacker to bypass Cisco FMC Software security restrictions and gain access to the underlying filesystem of the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-fmc-dir-trav
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-20191002-fmc-dir-trav?
The severity of cisco-sa-20191002-fmc-dir-trav is classified as high.
How do I fix cisco-sa-20191002-fmc-dir-trav?
To fix cisco-sa-20191002-fmc-dir-trav, upgrade to the latest version of Cisco FMC Software as recommended in the advisory.
Who is affected by cisco-sa-20191002-fmc-dir-trav?
Cisco Firepower Management Center (FMC) Software users with an affected version are susceptible to cisco-sa-20191002-fmc-dir-trav.
What type of attack can be executed using cisco-sa-20191002-fmc-dir-trav?
An authenticated remote attacker can exploit cisco-sa-20191002-fmc-dir-trav to perform a directory traversal attack.
What is the cause of cisco-sa-20191002-fmc-dir-trav?
The cisco-sa-20191002-fmc-dir-trav vulnerability is due to insufficient input validation in the web-based management interface.