CVE-2019-1867 | A vulnerability in the REST API of Cisco Elastic Services Co… | CVSS 10.0 CRITICAL

Description

A vulnerability in the REST API of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to bypass authentication on the REST API. The vulnerability is due to improper validation of API requests. An attacker could exploit this vulnerability by sending a crafted request to the REST API. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on an affected system.

Metadata

CVE ID: CVE-2019-1867
State: PUBLISHED
Assigner: cisco
Reserved: 2018-12-06 00:00 UTC
Published: 2019-05-10 12:05 UTC
Last updated: 2024-11-19 19:07 UTC
Primary CWE: CWE-287
CWE-287
Vendor / Product: Cisco / Cisco Elastic Services Controller
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.0

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Cisco	Cisco Elastic Services Controller	—	unspecified < 4.1.0.100, unspecified < 4.2.0.74, unspecified < 4.3.0.121, unspecified < 4.4.0.80

Weakness (CWE)

CWE	Source	Description
CWE-287	cna	CWE-287

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (1)

20190507 Cisco Elastic Services Controller REST API Authentication Bypass Vulnerability https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190507-esc-authbypass