BDU:2020-02752

Опубликовано: 03 июн. 2020

Источник: fstec

CVSS3: 8.8

CVSS2: 9

EPSS Низкий

Описание

Уязвимость веб-интерфейса операционной системы Cisco IOS XE связана с непринятием мер по чистке данных на управляющем уровне. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, оказать воздействие на конфиденциальность, целостность или доступность защищаемой информации

Вендор

Cisco Systems Inc.

Наименование ПО

Cisco IOS XE

Версия ПО

16.5.1 (Cisco IOS XE)

16.1.1 (Cisco IOS XE)

16.1.2 (Cisco IOS XE)

16.1.3 (Cisco IOS XE)

16.3.1a (Cisco IOS XE)

16.5.1a (Cisco IOS XE)

16.2.1 (Cisco IOS XE)

16.2.2 (Cisco IOS XE)

16.3.1 (Cisco IOS XE)

16.3.2 (Cisco IOS XE)

16.3.3 (Cisco IOS XE)

16.3.4 (Cisco IOS XE)

16.3.5 (Cisco IOS XE)

16.3.5b (Cisco IOS XE)

16.4.1 (Cisco IOS XE)

16.6.1 (Cisco IOS XE)

16.6.4 (Cisco IOS XE)

16.7.1b (Cisco IOS XE)

16.4.3 (Cisco IOS XE)

16.7.2 (Cisco IOS XE)

16.3.6 (Cisco IOS XE)

16.4.2 (Cisco IOS XE)

16.5.1b (Cisco IOS XE)

16.5.2 (Cisco IOS XE)

16.5.3 (Cisco IOS XE)

16.6.2 (Cisco IOS XE)

16.6.3 (Cisco IOS XE)

16.7.1 (Cisco IOS XE)

16.7.1a (Cisco IOS XE)

16.8.1 (Cisco IOS XE)

16.8.1s (Cisco IOS XE)

16.9.1b (Cisco IOS XE)

16.3.7 (Cisco IOS XE)

16.6.4s (Cisco IOS XE)

16.6.4a (Cisco IOS XE)

16.8.1b (Cisco IOS XE)

16.8.1a (Cisco IOS XE)

16.8.1c (Cisco IOS XE)

16.8.1d (Cisco IOS XE)

16.8.2 (Cisco IOS XE)

16.8.1e (Cisco IOS XE)

16.9.1 (Cisco IOS XE)

16.9.1a (Cisco IOS XE)

16.9.1s (Cisco IOS XE)

16.9.1c (Cisco IOS XE)

16.9.1d (Cisco IOS XE)

16.9.2a (Cisco IOS XE)

16.7.3 (Cisco IOS XE)

16.10.1 (Cisco IOS XE)

16.9.2h (Cisco IOS XE)

16.12.1 (Cisco IOS XE)

16.7.4 (Cisco IOS XE)

16.8.3 (Cisco IOS XE)

16.9.2s (Cisco IOS XE)

16.3.8 (Cisco IOS XE)

16.6.5 (Cisco IOS XE)

16.3.9 (Cisco IOS XE)

16.6.5a (Cisco IOS XE)

16.6.6 (Cisco IOS XE)

16.6.5b (Cisco IOS XE)

16.9.3 (Cisco IOS XE)

16.9.4 (Cisco IOS XE)

16.9.3s (Cisco IOS XE)

16.9.3a (Cisco IOS XE)

16.9.4c (Cisco IOS XE)

16.10.1a (Cisco IOS XE)

16.10.1b (Cisco IOS XE)

16.10.1s (Cisco IOS XE)

16.10.1e (Cisco IOS XE)

16.10.3 (Cisco IOS XE)

16.11.1 (Cisco IOS XE)

16.11.1a (Cisco IOS XE)

16.11.1b (Cisco IOS XE)

16.11.1s (Cisco IOS XE)

16.11.1c (Cisco IOS XE)

16.12.1a (Cisco IOS XE)

16.12.1y (Cisco IOS XE)

16.12.1s (Cisco IOS XE)

16.12.1t (Cisco IOS XE)

16.10.1c (Cisco IOS XE)

16.10.1d (Cisco IOS XE)

16.10.1f (Cisco IOS XE)

16.10.1g (Cisco IOS XE)

16.12.1w (Cisco IOS XE)

16.11.2 (Cisco IOS XE)

16.3.10 (Cisco IOS XE)

16.6.7 (Cisco IOS XE)

16.6.7a (Cisco IOS XE)

16.12.1x (Cisco IOS XE)

Тип ПО

Операционная система

Операционные системы и аппаратные платформы

Cisco Systems Inc. Cisco IOS XE 16.5.1

Cisco Systems Inc. Cisco IOS XE 16.1.1

Cisco Systems Inc. Cisco IOS XE 16.1.2

Cisco Systems Inc. Cisco IOS XE 16.1.3

Cisco Systems Inc. Cisco IOS XE 16.3.1a

Cisco Systems Inc. Cisco IOS XE 16.5.1a

Cisco Systems Inc. Cisco IOS XE 16.2.1

Cisco Systems Inc. Cisco IOS XE 16.2.2

Cisco Systems Inc. Cisco IOS XE 16.3.1

Cisco Systems Inc. Cisco IOS XE 16.3.2

Cisco Systems Inc. Cisco IOS XE 16.3.3

Cisco Systems Inc. Cisco IOS XE 16.3.4

Cisco Systems Inc. Cisco IOS XE 16.3.5

Cisco Systems Inc. Cisco IOS XE 16.3.5b

Cisco Systems Inc. Cisco IOS XE 16.4.1

Cisco Systems Inc. Cisco IOS XE 16.6.1

Cisco Systems Inc. Cisco IOS XE 16.6.4

Cisco Systems Inc. Cisco IOS XE 16.7.1b

Cisco Systems Inc. Cisco IOS XE 16.4.3

Cisco Systems Inc. Cisco IOS XE 16.7.2

Cisco Systems Inc. Cisco IOS XE 16.3.6

Cisco Systems Inc. Cisco IOS XE 16.4.2

Cisco Systems Inc. Cisco IOS XE 16.5.1b

Cisco Systems Inc. Cisco IOS XE 16.5.2

Cisco Systems Inc. Cisco IOS XE 16.5.3

Cisco Systems Inc. Cisco IOS XE 16.6.2

Cisco Systems Inc. Cisco IOS XE 16.6.3

Cisco Systems Inc. Cisco IOS XE 16.7.1

Cisco Systems Inc. Cisco IOS XE 16.7.1a

Cisco Systems Inc. Cisco IOS XE 16.8.1

Cisco Systems Inc. Cisco IOS XE 16.8.1s

Cisco Systems Inc. Cisco IOS XE 16.9.1b

Cisco Systems Inc. Cisco IOS XE 16.3.7

Cisco Systems Inc. Cisco IOS XE 16.6.4s

Cisco Systems Inc. Cisco IOS XE 16.6.4a

Cisco Systems Inc. Cisco IOS XE 16.8.1b

Cisco Systems Inc. Cisco IOS XE 16.8.1a

Cisco Systems Inc. Cisco IOS XE 16.8.1c

Cisco Systems Inc. Cisco IOS XE 16.8.1d

Cisco Systems Inc. Cisco IOS XE 16.8.2

Cisco Systems Inc. Cisco IOS XE 16.8.1e

Cisco Systems Inc. Cisco IOS XE 16.9.1

Cisco Systems Inc. Cisco IOS XE 16.9.1a

Cisco Systems Inc. Cisco IOS XE 16.9.1s

Cisco Systems Inc. Cisco IOS XE 16.9.1c

Cisco Systems Inc. Cisco IOS XE 16.9.1d

Cisco Systems Inc. Cisco IOS XE 16.9.2a

Cisco Systems Inc. Cisco IOS XE 16.7.3

Cisco Systems Inc. Cisco IOS XE 16.10.1

Cisco Systems Inc. Cisco IOS XE 16.9.2h

Cisco Systems Inc. Cisco IOS XE 16.12.1

Cisco Systems Inc. Cisco IOS XE 16.7.4

Cisco Systems Inc. Cisco IOS XE 16.8.3

Cisco Systems Inc. Cisco IOS XE 16.9.2s

Cisco Systems Inc. Cisco IOS XE 16.3.8

Cisco Systems Inc. Cisco IOS XE 16.6.5

Cisco Systems Inc. Cisco IOS XE 16.3.9

Cisco Systems Inc. Cisco IOS XE 16.6.5a

Cisco Systems Inc. Cisco IOS XE 16.6.6

Cisco Systems Inc. Cisco IOS XE 16.6.5b

Cisco Systems Inc. Cisco IOS XE 16.9.3

Cisco Systems Inc. Cisco IOS XE 16.9.4

Cisco Systems Inc. Cisco IOS XE 16.9.3s

Cisco Systems Inc. Cisco IOS XE 16.9.3a

Cisco Systems Inc. Cisco IOS XE 16.9.4c

Cisco Systems Inc. Cisco IOS XE 16.10.1a

Cisco Systems Inc. Cisco IOS XE 16.10.1b

Cisco Systems Inc. Cisco IOS XE 16.10.1s

Cisco Systems Inc. Cisco IOS XE 16.10.1e

Cisco Systems Inc. Cisco IOS XE 16.10.3

Cisco Systems Inc. Cisco IOS XE 16.11.1

Cisco Systems Inc. Cisco IOS XE 16.11.1a

Cisco Systems Inc. Cisco IOS XE 16.11.1b

Cisco Systems Inc. Cisco IOS XE 16.11.1s

Cisco Systems Inc. Cisco IOS XE 16.11.1c

Cisco Systems Inc. Cisco IOS XE 16.12.1a

Cisco Systems Inc. Cisco IOS XE 16.12.1y

Cisco Systems Inc. Cisco IOS XE 16.12.1s

Cisco Systems Inc. Cisco IOS XE 16.12.1t

Cisco Systems Inc. Cisco IOS XE 16.10.1c

Cisco Systems Inc. Cisco IOS XE 16.10.1d

Cisco Systems Inc. Cisco IOS XE 16.10.1f

Cisco Systems Inc. Cisco IOS XE 16.10.1g

Cisco Systems Inc. Cisco IOS XE 16.12.1w

Cisco Systems Inc. Cisco IOS XE 16.11.2

Cisco Systems Inc. Cisco IOS XE 16.3.10

Cisco Systems Inc. Cisco IOS XE 16.6.7

Cisco Systems Inc. Cisco IOS XE 16.6.7a

Cisco Systems Inc. Cisco IOS XE 16.12.1x

Уровень опасности уязвимости

Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 9)

Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 8,8)

Возможные меры по устранению уязвимости

Использование рекомендаций:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-web-cmdinj2-fOnjk2LD

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Ссылки на источники

Идентификаторы других систем описаний уязвимостей

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-3219
CVE

EPSS

Процентиль: 64%

0.00471

Низкий

8.8 High

CVSS3

9 Critical

CVSS2

Связанные уязвимости

CVE-2020-3219

CVSS3: 8.8

nvd

больше 5 лет назад

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with administrative privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of user-supplied input to the web UI. An attacker could exploit this vulnerability by submitting crafted input to the web UI. A successful exploit could allow an attacker to execute arbitrary commands with administrative privileges on an affected device.

GHSA-2hc6-pjqv-vf75

CVSS3: 8.8

github

больше 3 лет назад

BDU:2020-02762

CVSS3: 8.8

fstec

больше 5 лет назад

Уязвимость компонента Cisco One Platform Kit (onePK) операционных систем Cisco IOS, Cisco IOS XE и Cisco NX-OS, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании

EPSS

Процентиль: 64%

0.00471

Низкий

8.8 High

CVSS3

9 Critical

CVSS2