CVE-2019-1742 — Cisco IOS XE Software vulnerability

CWE-164 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
1.0%
top 23.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco IOS XE SoftwareCisco IOS XE
Timeline
PublishedMar 28
Latest updateMay 13

Description

A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access sensitive configuration information. The vulnerability is due to improper access control to files within the web UI. An attacker could exploit this vulnerability by sending a malicious request to an affected device. A successful exploit could allow the attacker to gain access to sensitive configuration information.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5cisco/cisco_ios_xe_software23 versions+22
▶NVDcisco/ios_xe23 versions+22

Patches

Patch: tools.cisco.com ↗Patch: tools.cisco.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-ccxx-8mwm-gh8r: A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access sensitive configuration information↗2022-05-13
▶
CVEList
Cisco IOS XE Software Information Disclosure Vulnerability↗2019-03-27
▶

📋Vendor Advisories

1
Cisco
Cisco IOS XE Software Information Disclosure Vulnerability↗2019-03-27
▶
CVE-2019-1742 — Cisco IOS XE Software vulnerability | cvebase