Vulnslist

find the latest Cisco vulnerabilities

Cisco Network Analysis Module Parameter Directory Traversal Arbitrary File Deletion Vulnerability

cisco-sa-20171018-nam · Medium · Published · Updated

A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete arbitrary files from an affected system. The vulnerability exists because the affected software does not perform proper input validation of HTTP requests that it receives and the software does not apply role-based access controls (RBACs) to requested HTTP URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow the attacker to delete arbitrary files from the affected system. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-nam

Cisco advisory ·CSAF JSON

Workarounds

There are no workarounds that address this vulnerability.

CVEsCVE-2017-12285
Cisco Bug IDsCSCvf41365
CVSS ScoreBase 6.5
Base 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:X
Product Names From Source
Cisco Prime Network Analysis Module Software

Related Products

Product CVE Evidence
Cisco Nexus Dashboard CVE-2017-12285 Cisco OpenVuln
Cisco Application Centric Infrastructure Virtual Edge CVE-2017-12285 Cisco OpenVuln
Cisco Prime Network Analysis Module Software CVE-2017-12285 Cisco OpenVuln
Cisco Prime Network CVE-2017-12285 Cisco OpenVuln