CVE-2019-1818
Description
A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information.
How to fix
- cisco evolved_programmable_network_manager3.0.1 or later
- cisco prime_infrastructure3.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco evolved_programmable_network_manager | v < 3.0.1 | 3.0.1 |
| cisco prime_infrastructure | v < 3.4 | 3.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.