Vulnerability in Cisco Application Policy Infrastructure Controller Software
CVE-2019-1585
A vulnerability in the controller authorization functionality of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker to escalate standard users with root privilege on an affected device. The vulnerability is due to a misconfiguration of certain sudoers files for the bashroot component on an affected device. An attacker could exploit this vulnerability by authenticating to the affected device with a crafted user ID, which may allow temporary administrative access to escalate privileges. A successful exploit could allow the attacker to escalate privileges on an affected device. This Vulnerability has been fixed in version 4.0(1h)
EPSS: 0.004 (31.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Cisco Application_policy_infrastructure_controller_software
- Cisco Nx-os Software For Nexus 9000 Series Fabric Switches Aci Mode — versions unspecified
- Cisco Nexus_92160yc-x
- Cisco Nexus_92304qc
- Cisco Nexus_9236c
- Cisco Nexus_9272q
- Cisco Nexus_93108tc-ex
- Cisco Nexus_93120tx
- Cisco Nexus_93128tx
- Cisco Nexus_93180yc-ex
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
- psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2019-1585?
- CVE-2019-1585 is a medium-severity vulnerability in Cisco Application Policy Infrastructure Controller Software, classified under CWE-16. CVSS score: 6.7/10. Published 2019-03-06.
- How severe is CVE-2019-1585?
- Medium severity. CVSS v3 base score is 6.7 out of 10.