CVE-2019-1917 (GCVE-0-2019-1917)
Vulnerability from cvelistv5 – Published: 2019-07-17 20:15 – Updated: 2024-11-19 19:02
VLAI?
Summary
A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on the affected system. The REST API is enabled by default and cannot be disabled.
Severity ?
9.1 (Critical)
CWE
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco Vision Dynamic Signage Director |
Affected:
unspecified , < 6.1sp3
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T18:35:51.282Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190717 Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth"
},
{
"name": "109301",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/109301"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2019-1917",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-19T17:21:16.171303Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-19T19:02:34.831Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco Vision Dynamic Signage Director",
"vendor": "Cisco",
"versions": [
{
"lessThan": "6.1sp3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2019-07-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on the affected system. The REST API is enabled by default and cannot be disabled."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-22T06:06:02",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20190717 Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth"
},
{
"name": "109301",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/109301"
}
],
"source": {
"advisory": "cisco-sa-20190717-cvdsd-wmauth",
"defect": [
[
"CSCvo52767"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2019-07-17T16:00:00-0700",
"ID": "CVE-2019-1917",
"STATE": "PUBLIC",
"TITLE": "Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco Vision Dynamic Signage Director",
"version": {
"version_data": [
{
"affected": "\u003c",
"version_affected": "\u003c",
"version_value": "6.1sp3"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on the affected system. The REST API is enabled by default and cannot be disabled."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "9.1",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-287"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190717 Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth"
},
{
"name": "109301",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/109301"
}
]
},
"source": {
"advisory": "cisco-sa-20190717-cvdsd-wmauth",
"defect": [
[
"CSCvo52767"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2019-1917",
"datePublished": "2019-07-17T20:15:15.384964Z",
"dateReserved": "2018-12-06T00:00:00",
"dateUpdated": "2024-11-19T19:02:34.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:vision_dynamic_signage_director:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"5.0\", \"matchCriteriaId\": \"B205A444-BDE5-4243-81D6-8EAFA0C434BE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:vision_dynamic_signage_director:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.0\", \"versionEndIncluding\": \"6.1\", \"matchCriteriaId\": \"8C55ACC2-A3B1-4E1A-833F-88487109EA33\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp1:*:*:*:*:*:*\", \"matchCriteriaId\": \"4C3F9C24-A823-464C-B0D7-8433C3EB77A4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp2:*:*:*:*:*:*\", \"matchCriteriaId\": \"FA2B415C-18A3-4164-B30F-9444BF53DFAE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp3:*:*:*:*:*:*\", \"matchCriteriaId\": \"1E419201-F41A-41FB-B4A0-AED3B306720C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp4:*:*:*:*:*:*\", \"matchCriteriaId\": \"9BB08AC9-C1E2-4026-A733-4440A5D86F9F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp5:*:*:*:*:*:*\", \"matchCriteriaId\": \"E536AFFE-8C94-4626-9D8E-8E9A3EC5E5EC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp6:*:*:*:*:*:*\", \"matchCriteriaId\": \"D117D5BE-282C-4FAC-A3F1-096B0B4C8BC2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp7:*:*:*:*:*:*\", \"matchCriteriaId\": \"AD686438-548D-4013-9826-A2F4860E9D90\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp8:*:*:*:*:*:*\", \"matchCriteriaId\": \"C9D817B7-CDD6-4B72-AAB0-447BF1215E18\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:vision_dynamic_signage_director:6.1:sp1:*:*:*:*:*:*\", \"matchCriteriaId\": \"3E6A9C11-7FEF-4716-BFB3-B95CC687970D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:vision_dynamic_signage_director:6.1:sp2:*:*:*:*:*:*\", \"matchCriteriaId\": \"5051F39D-30BC-4130-A4C0-348EFF321064\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on the affected system. The REST API is enabled by default and cannot be disabled.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad en la interfaz de la API REST de Vision Dynamic Signage Director de Cisco, podr\\u00eda permitir que un atacante remoto no autenticado omita la autenticaci\\u00f3n en un sistema afectado. La vulnerabilidad es debido a una comprobaci\\u00f3n insuficiente de las peticiones HTTP. Un atacante podr\\u00eda explotar esta vulnerabilidad mediante el env\\u00edo de una petici\\u00f3n HTTP dise\\u00f1ada hacia un sistema afectado. Una explotaci\\u00f3n con \\u00e9xito podr\\u00eda permitir al atacante ejecutar acciones arbitrarias por medio de la API REST con privilegios administrativos en el sistema afectado. La API REST est\\u00e1 habilitada por defecto y no se puede deshabilitar.\"}]",
"id": "CVE-2019-1917",
"lastModified": "2024-11-21T04:37:40.923",
"metrics": "{\"cvssMetricV30\": [{\"source\": \"ykramarz@cisco.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"baseScore\": 9.1, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.2}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:C/I:C/A:C\", \"baseScore\": 10.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2019-07-17T21:15:11.937",
"references": "[{\"url\": \"http://www.securityfocus.com/bid/109301\", \"source\": \"ykramarz@cisco.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth\", \"source\": \"ykramarz@cisco.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/109301\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"ykramarz@cisco.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-287\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-287\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2019-1917\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2019-07-17T21:15:11.937\",\"lastModified\":\"2024-11-21T04:37:40.923\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on the affected system. The REST API is enabled by default and cannot be disabled.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en la interfaz de la API REST de Vision Dynamic Signage Director de Cisco, podr\u00eda permitir que un atacante remoto no autenticado omita la autenticaci\u00f3n en un sistema afectado. La vulnerabilidad es debido a una comprobaci\u00f3n insuficiente de las peticiones HTTP. Un atacante podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de una petici\u00f3n HTTP dise\u00f1ada hacia un sistema afectado. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante ejecutar acciones arbitrarias por medio de la API REST con privilegios administrativos en el sistema afectado. La API REST est\u00e1 habilitada por defecto y no se puede deshabilitar.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":10.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:vision_dynamic_signage_director:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"5.0\",\"matchCriteriaId\":\"B205A444-BDE5-4243-81D6-8EAFA0C434BE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:vision_dynamic_signage_director:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0\",\"versionEndIncluding\":\"6.1\",\"matchCriteriaId\":\"8C55ACC2-A3B1-4E1A-833F-88487109EA33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C3F9C24-A823-464C-B0D7-8433C3EB77A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp2:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA2B415C-18A3-4164-B30F-9444BF53DFAE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp3:*:*:*:*:*:*\",\"matchCriteriaId\":\"1E419201-F41A-41FB-B4A0-AED3B306720C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp4:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BB08AC9-C1E2-4026-A733-4440A5D86F9F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp5:*:*:*:*:*:*\",\"matchCriteriaId\":\"E536AFFE-8C94-4626-9D8E-8E9A3EC5E5EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp6:*:*:*:*:*:*\",\"matchCriteriaId\":\"D117D5BE-282C-4FAC-A3F1-096B0B4C8BC2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp7:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD686438-548D-4013-9826-A2F4860E9D90\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp8:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9D817B7-CDD6-4B72-AAB0-447BF1215E18\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:vision_dynamic_signage_director:6.1:sp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3E6A9C11-7FEF-4716-BFB3-B95CC687970D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:vision_dynamic_signage_director:6.1:sp2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5051F39D-30BC-4130-A4C0-348EFF321064\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/109301\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/109301\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth\", \"name\": \"20190717 Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability\", \"tags\": [\"vendor-advisory\", \"x_refsource_CISCO\", \"x_transferred\"]}, {\"url\": \"http://www.securityfocus.com/bid/109301\", \"name\": \"109301\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T18:35:51.282Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2019-1917\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-19T17:21:16.171303Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-19T17:21:50.876Z\"}}], \"cna\": {\"title\": \"Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability\", \"source\": {\"defect\": [[\"CSCvo52767\"]], \"advisory\": \"cisco-sa-20190717-cvdsd-wmauth\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"cvssV3_0\": {\"scope\": \"UNCHANGED\", \"version\": \"3.0\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco Vision Dynamic Signage Director\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"6.1sp3\", \"versionType\": \"custom\"}]}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.\"}], \"datePublic\": \"2019-07-17T00:00:00\", \"references\": [{\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth\", \"name\": \"20190717 Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability\", \"tags\": [\"vendor-advisory\", \"x_refsource_CISCO\"]}, {\"url\": \"http://www.securityfocus.com/bid/109301\", \"name\": \"109301\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on the affected system. The REST API is enabled by default and cannot be disabled.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-287\", \"description\": \"CWE-287\"}]}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2019-07-22T06:06:02\"}, \"x_legacyV4Record\": {\"impact\": {\"cvss\": {\"version\": \"3.0\", \"baseScore\": \"9.1\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\"}}, \"source\": {\"defect\": [[\"CSCvo52767\"]], \"advisory\": \"cisco-sa-20190717-cvdsd-wmauth\", \"discovery\": \"INTERNAL\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"affected\": \"\u003c\", \"version_value\": \"6.1sp3\", \"version_affected\": \"\u003c\"}]}, \"product_name\": \"Cisco Vision Dynamic Signage Director\"}]}, \"vendor_name\": \"Cisco\"}]}}, \"exploit\": [{\"lang\": \"en\", \"value\": \"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.\"}], \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth\", \"name\": \"20190717 Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability\", \"refsource\": \"CISCO\"}, {\"url\": \"http://www.securityfocus.com/bid/109301\", \"name\": \"109301\", \"refsource\": \"BID\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on the affected system. The REST API is enabled by default and cannot be disabled.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-287\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2019-1917\", \"STATE\": \"PUBLIC\", \"TITLE\": \"Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability\", \"ASSIGNER\": \"psirt@cisco.com\", \"DATE_PUBLIC\": \"2019-07-17T16:00:00-0700\"}}}}",
"cveMetadata": "{\"cveId\": \"CVE-2019-1917\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-19T19:02:34.831Z\", \"dateReserved\": \"2018-12-06T00:00:00\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"datePublished\": \"2019-07-17T20:15:15.384964Z\", \"assignerShortName\": \"cisco\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…