cnvd - cnvd-2020-12742

CNVD-2020-12742

Vulnerability from cnvd - Published: 2020-02-23

Title

Cisco AMP Threat Grid Cloud和AMP Threat Grid Appliance software信任管理问题漏洞

Description

Cisco AMP Threat Grid Cloud和AMP Threat Grid Appliance software都是美国思科（Cisco）公司的产品。Cisco AMP Threat Grid Cloud是一款基于云的恶意软件和威胁情报分析解决方案。AMP Threat Grid Appliance software是一套部署在设备中的恶意软件分析解决方案。 Cisco AMP Threat Grid Cloud和AMP Threat Grid Appliance software存在信任管理问题漏洞，该漏洞源于程序未安全地创建API密钥。攻击者可通过使用不安全的凭证利用该漏洞访问敏感信息。

Severity

中

Patch Name

Cisco AMP Threat Grid Cloud和AMP Threat Grid Appliance software信任管理问题漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-threat-grid

Reference

https://nvd.nist.gov/vuln/detail/CVE-2019-1657

Impacted products

Name
['Cisco AMP Threat Grid Cloud <3.5.68', 'Cisco AMP Threat Grid Appliance software <2.5']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-1657"
    }
  },
  "description": "Cisco AMP Threat Grid Cloud\u548cAMP Threat Grid Appliance software\u90fd\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Cisco AMP Threat Grid Cloud\u662f\u4e00\u6b3e\u57fa\u4e8e\u4e91\u7684\u6076\u610f\u8f6f\u4ef6\u548c\u5a01\u80c1\u60c5\u62a5\u5206\u6790\u89e3\u51b3\u65b9\u6848\u3002AMP Threat Grid Appliance software\u662f\u4e00\u5957\u90e8\u7f72\u5728\u8bbe\u5907\u4e2d\u7684\u6076\u610f\u8f6f\u4ef6\u5206\u6790\u89e3\u51b3\u65b9\u6848\u3002\n\nCisco AMP Threat Grid Cloud\u548cAMP Threat Grid Appliance software\u5b58\u5728\u4fe1\u4efb\u7ba1\u7406\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u5b89\u5168\u5730\u521b\u5efaAPI\u5bc6\u94a5\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u4f7f\u7528\u4e0d\u5b89\u5168\u7684\u51ed\u8bc1\u5229\u7528\u8be5\u6f0f\u6d1e\u8bbf\u95ee\u654f\u611f\u4fe1\u606f\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-threat-grid",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-12742",
  "openTime": "2020-02-23",
  "patchDescription": "Cisco AMP Threat Grid Cloud\u548cAMP Threat Grid Appliance software\u90fd\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Cisco AMP Threat Grid Cloud\u662f\u4e00\u6b3e\u57fa\u4e8e\u4e91\u7684\u6076\u610f\u8f6f\u4ef6\u548c\u5a01\u80c1\u60c5\u62a5\u5206\u6790\u89e3\u51b3\u65b9\u6848\u3002AMP Threat Grid Appliance software\u662f\u4e00\u5957\u90e8\u7f72\u5728\u8bbe\u5907\u4e2d\u7684\u6076\u610f\u8f6f\u4ef6\u5206\u6790\u89e3\u51b3\u65b9\u6848\u3002\r\n\r\nCisco AMP Threat Grid Cloud\u548cAMP Threat Grid Appliance software\u5b58\u5728\u4fe1\u4efb\u7ba1\u7406\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u5b89\u5168\u5730\u521b\u5efaAPI\u5bc6\u94a5\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u4f7f\u7528\u4e0d\u5b89\u5168\u7684\u51ed\u8bc1\u5229\u7528\u8be5\u6f0f\u6d1e\u8bbf\u95ee\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco AMP Threat Grid Cloud\u548cAMP Threat Grid Appliance software\u4fe1\u4efb\u7ba1\u7406\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Cisco AMP Threat Grid Cloud \u003c3.5.68",
      "Cisco AMP Threat Grid Appliance software \u003c2.5"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-1657",
  "serverity": "\u4e2d",
  "submitTime": "2019-01-25",
  "title": "Cisco AMP Threat Grid Cloud\u548cAMP Threat Grid Appliance software\u4fe1\u4efb\u7ba1\u7406\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2019-1657 (GCVE-0-2019-1657)

Vulnerability from cvelistv5 – Published: 2019-01-24 16:00 – Updated: 2024-11-21 19:47

Title

Cisco AMP Threat Grid API Key Information Disclosure Vulnerability

Summary

A vulnerability in Cisco AMP Threat Grid could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to unsafe creation of API keys. An attacker could exploit this vulnerability by using insecure credentials to gain unauthorized access to the affected device. An exploit could allow the attacker to gain unauthorized access to information by using the API key credentials.

Severity ?

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-200

Assigner

cisco

References

URL

Tags

	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.securityfocus.com/bid/106711	vdb-entryx_refsource_BID

Impacted products

	Vendor	Product	Version
	Cisco	Cisco AMP Threat Grid Appliance Software	Affected: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T18:20:28.361Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20190123 Cisco AMP Threat Grid API Key Information Disclosure Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-threat-grid"
          },
          {
            "name": "106711",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106711"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2019-1657",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-21T19:00:53.232163Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-21T19:47:19.912Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco AMP Threat Grid Appliance Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2019-01-23T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in Cisco AMP Threat Grid could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to unsafe creation of API keys. An attacker could exploit this vulnerability by using insecure credentials to gain unauthorized access to the affected device. An exploit could allow the attacker to gain unauthorized access to information by using the API key credentials."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-01-25T10:57:01",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20190123 Cisco AMP Threat Grid API Key Information Disclosure Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-threat-grid"
        },
        {
          "name": "106711",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106711"
        }
      ],
      "source": {
        "advisory": "cisco-sa-20190123-threat-grid",
        "defect": [
          [
            "NA"
          ]
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco AMP Threat Grid API Key Information Disclosure Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2019-01-23T16:00:00-0800",
          "ID": "CVE-2019-1657",
          "STATE": "PUBLIC",
          "TITLE": "Cisco AMP Threat Grid API Key Information Disclosure Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco AMP Threat Grid Appliance Software",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in Cisco AMP Threat Grid could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to unsafe creation of API keys. An attacker could exploit this vulnerability by using insecure credentials to gain unauthorized access to the affected device. An exploit could allow the attacker to gain unauthorized access to information by using the API key credentials."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
          }
        ],
        "impact": {
          "cvss": {
            "baseScore": "4.3",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20190123 Cisco AMP Threat Grid API Key Information Disclosure Vulnerability",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-threat-grid"
            },
            {
              "name": "106711",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106711"
            }
          ]
        },
        "source": {
          "advisory": "cisco-sa-20190123-threat-grid",
          "defect": [
            [
              "NA"
            ]
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2019-1657",
    "datePublished": "2019-01-24T16:00:00Z",
    "dateReserved": "2018-12-06T00:00:00",
    "dateUpdated": "2024-11-21T19:47:19.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2020-12742

CVE-2019-1657 (GCVE-0-2019-1657)

Tags

Sightings

Nomenclature