CVE-2019-1917

{"containers": {"cna": {"affected": [{"product": "Cisco Vision Dynamic Signage Director", "vendor": "Cisco", "versions": [{"lessThan": "6.1sp3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2019-07-17T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on the affected system. The REST API is enabled by default and cannot be disabled."}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "CWE-287", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-07-22T06:06:02.000Z", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco"}, "references": [{"name": "20190717 Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth"}, {"name": "109301", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/109301"}], "source": {"advisory": "cisco-sa-20190717-cvdsd-wmauth", "defect": [["CSCvo52767"]], "discovery": "INTERNAL"}, "title": "Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@cisco.com", "DATE_PUBLIC": "2019-07-17T16:00:00-0700", "ID": "CVE-2019-1917", "STATE": "PUBLIC", "TITLE": "Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Cisco Vision Dynamic Signage Director", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_value": "6.1sp3"}]}}]}, "vendor_name": "Cisco"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on the affected system. The REST API is enabled by default and cannot be disabled."}]}, "exploit": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "impact": {"cvss": {"baseScore": "9.1", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-287"}]}]}, "references": {"reference_data": [{"name": "20190717 Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability", "refsource": "CISCO", "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth"}, {"name": "109301", "refsource": "BID", "url": "http://www.securityfocus.com/bid/109301"}]}, "source": {"advisory": "cisco-sa-20190717-cvdsd-wmauth", "defect": [["CSCvo52767"]], "discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T18:35:51.282Z"}, "title": "CVE Program Container", "references": [{"name": "20190717 Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability", "tags": ["vendor-advisory", "x_refsource_CISCO", "x_transferred"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth"}, {"name": "109301", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/109301"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-19T17:21:16.171303Z", "id": "CVE-2019-1917", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-19T19:02:34.831Z"}}]}, "cveMetadata": {"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2019-1917", "datePublished": "2019-07-17T20:15:15.384Z", "dateReserved": "2018-12-06T00:00:00.000Z", "dateUpdated": "2024-11-19T19:02:34.831Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth", "name": "20190717 Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability", "tags": ["vendor-advisory", "x_refsource_CISCO", "x_transferred"]}, {"url": "http://www.securityfocus.com/bid/109301", "name": "109301", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T18:35:51.282Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2019-1917", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-19T17:21:16.171303Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-19T17:21:50.876Z"}}], "cna": {"title": "Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability", "source": {"defect": [["CSCvo52767"]], "advisory": "cisco-sa-20190717-cvdsd-wmauth", "discovery": "INTERNAL"}, "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Vision Dynamic Signage Director", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "6.1sp3", "versionType": "custom"}]}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "datePublic": "2019-07-17T00:00:00.000Z", "references": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth", "name": "20190717 Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability", "tags": ["vendor-advisory", "x_refsource_CISCO"]}, {"url": "http://www.securityfocus.com/bid/109301", "name": "109301", "tags": ["vdb-entry", "x_refsource_BID"]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on the affected system. The REST API is enabled by default and cannot be disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2019-07-22T06:06:02.000Z"}, "x_legacyV4Record": {"impact": {"cvss": {"version": "3.0", "baseScore": "9.1", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}}, "source": {"defect": [["CSCvo52767"]], "advisory": "cisco-sa-20190717-cvdsd-wmauth", "discovery": "INTERNAL"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"affected": "<", "version_value": "6.1sp3", "version_affected": "<"}]}, "product_name": "Cisco Vision Dynamic Signage Director"}]}, "vendor_name": "Cisco"}]}}, "exploit": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "data_type": "CVE", "references": {"reference_data": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth", "name": "20190717 Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability", "refsource": "CISCO"}, {"url": "http://www.securityfocus.com/bid/109301", "name": "109301", "refsource": "BID"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on the affected system. The REST API is enabled by default and cannot be disabled."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-287"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2019-1917", "STATE": "PUBLIC", "TITLE": "Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability", "ASSIGNER": "psirt@cisco.com", "DATE_PUBLIC": "2019-07-17T16:00:00-0700"}}}}, "cveMetadata": {"cveId": "CVE-2019-1917", "state": "PUBLISHED", "dateUpdated": "2024-11-19T19:02:34.831Z", "dateReserved": "2018-12-06T00:00:00.000Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2019-07-17T20:15:15.384Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Cisco Vision Dynamic Signage Director", "vendor": "Cisco", "versions": [{"lessThan": "6.1sp3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "psirt@cisco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:vision_dynamic_signage_director:*:*:*:*:*:*:*:*", "matchCriteriaId": "B205A444-BDE5-4243-81D6-8EAFA0C434BE", "versionEndIncluding": "5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:vision_dynamic_signage_director:*:*:*:*:*:*:*:*", "matchCriteriaId": "8C55ACC2-A3B1-4E1A-833F-88487109EA33", "versionEndIncluding": "6.1", "versionStartIncluding": "6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp1:*:*:*:*:*:*", "matchCriteriaId": "4C3F9C24-A823-464C-B0D7-8433C3EB77A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp2:*:*:*:*:*:*", "matchCriteriaId": "FA2B415C-18A3-4164-B30F-9444BF53DFAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp3:*:*:*:*:*:*", "matchCriteriaId": "1E419201-F41A-41FB-B4A0-AED3B306720C", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp4:*:*:*:*:*:*", "matchCriteriaId": "9BB08AC9-C1E2-4026-A733-4440A5D86F9F", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp5:*:*:*:*:*:*", "matchCriteriaId": "E536AFFE-8C94-4626-9D8E-8E9A3EC5E5EC", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp6:*:*:*:*:*:*", "matchCriteriaId": "D117D5BE-282C-4FAC-A3F1-096B0B4C8BC2", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp7:*:*:*:*:*:*", "matchCriteriaId": "AD686438-548D-4013-9826-A2F4860E9D90", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:vision_dynamic_signage_director:5.0:sp8:*:*:*:*:*:*", "matchCriteriaId": "C9D817B7-CDD6-4B72-AAB0-447BF1215E18", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:vision_dynamic_signage_director:6.1:sp1:*:*:*:*:*:*", "matchCriteriaId": "3E6A9C11-7FEF-4716-BFB3-B95CC687970D", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:vision_dynamic_signage_director:6.1:sp2:*:*:*:*:*:*", "matchCriteriaId": "5051F39D-30BC-4130-A4C0-348EFF321064", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on the affected system. The REST API is enabled by default and cannot be disabled."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de la API REST de Vision Dynamic Signage Director de Cisco, podr\u00eda permitir que un atacante remoto no autenticado omita la autenticaci\u00f3n en un sistema afectado. La vulnerabilidad es debido a una comprobaci\u00f3n insuficiente de las peticiones HTTP. Un atacante podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de una petici\u00f3n HTTP dise\u00f1ada hacia un sistema afectado. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante ejecutar acciones arbitrarias por medio de la API REST con privilegios administrativos en el sistema afectado. La API REST est\u00e1 habilitada por defecto y no se puede deshabilitar."}], "id": "CVE-2019-1917", "lastModified": "2026-06-17T02:29:36.087", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "psirt@cisco.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2019-1917", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-11-19T17:21:16.171303Z", "version": "2.0.3"}}]}, "published": "2019-07-17T21:15:11.937", "references": [{"source": "psirt@cisco.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/109301"}, {"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/109301"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "psirt@cisco.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}