Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2019-1753

Опубликовано: 28 мар. 2019
Источник: nvd
CVSS3: 8.8
CVSS2: 9
EPSS Низкий

Описание

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to a failure to validate and sanitize input in Web Services Management Agent (WSMA) functions. An attacker could exploit this vulnerability by submitting a malicious payload to the affected device's web UI. A successful exploit could allow the lower-privileged attacker to execute arbitrary commands with higher privileges on the affected device.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:cisco:ios_xe:3.2.0ja:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:3.6.10e:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:16.6.1:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:16.6.2:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:16.6.3:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:16.7.1:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:16.7.1a:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:16.7.1b:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:16.8.1:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:16.8.1a:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:16.8.1b:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:16.8.1c:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:16.8.1d:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:16.8.1e:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios_xe:16.8.1s:*:*:*:*:*:*:*

EPSS

Процентиль: 77%
0.01019
Низкий

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-20
CWE-20

Связанные уязвимости

github логотип

GHSA-c7q8-hx63-756r

CVSS3: 8.8
github
больше 3 лет назад

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to a failure to validate and sanitize input in Web Services Management Agent (WSMA) functions. An attacker could exploit this vulnerability by submitting a malicious payload to the affected device's web UI. A successful exploit could allow the lower-privileged attacker to execute arbitrary commands with higher privileges on the affected device.

fstec логотип

BDU:2019-01329

CVSS3: 8.8
fstec
почти 7 лет назад

Уязвимость компонента Web Services Management Agent веб-интерфейса операционной системы Cisco IOS XE, позволяющая нарушителю выполнять команды с повышенными привилегиями

EPSS

Процентиль: 77%
0.01019
Низкий

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-20
CWE-20