CVE-2019-12623 — Cisco Enterprise Network Functions Virtualization Infrastructure Software File Enumeration Vulnerability

Description (CNA)

A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform file enumeration on an affected system. The vulnerability is due to the web server responding with different error codes for existing and non-existing files. An attacker could exploit this vulnerability by sending GET requests for different file names. A successful exploit could allow the attacker to enumerate files residing on the system.

Affected (CNA)

Vendor / product	Versions
Cisco / Cisco Enterprise NFV Infrastructure Software	affected unspecified before 3.12.1

CWE

CWE-538

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-nfv-enumeration

ADP enrichment

CVE

No English description supplied.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-nfv-enumeration

CISA-ADP

No English description supplied.

No references supplied.