CVE-2019-1876

{"id": "CVE-2019-1876", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 4.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2019-06-20T03:15:12.167", "references": [{"url": "http://www.securityfocus.com/bid/108863", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-waas-authbypass", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-306"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the HTTPS proxy feature of Cisco Wide Area Application Services (WAAS) Software could allow an unauthenticated, remote attacker to use the Central Manager as an HTTPS proxy. The vulnerability is due to insufficient authentication of proxy connection requests. An attacker could exploit this vulnerability by sending a malicious HTTPS CONNECT message to the Central Manager. A successful exploit could allow the attacker to access public internet resources that would normally be blocked by corporate policies."}, {"lang": "es", "value": "Una vulnerabilidad en la funci\u00f3n proxy HTTPS del software Wide Area Application Services (WAAS) de Cisco, podr\u00eda permitir a un atacante remoto no autenticado utilizar el Administrador Central como un proxy HTTPS. Una vulnerabilidad es debido a una autenticaci\u00f3n insuficiente de las peticiones de conexi\u00f3n de proxy. Un atacante podr\u00eda explotar esta vulnerabilidad enviando un mensaje malicioso de CONEXI\u00d3N HTTPS al Administrador Central. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante acceder a recursos p\u00fablicos de Internet que estar\u00edan bloqueados normalmente por las pol\u00edticas corporativas."}], "lastModified": "2019-10-09T23:48:24.613", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:wide_area_application_services:5.5\\(7\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB9CB497-9C85-452A-B7E1-F3CB76396A1D"}, {"criteria": "cpe:2.3:a:cisco:wide_area_application_services:6.1\\(1\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "729A2A6D-E9F9-4FAC-9FBB-DDD1810E08BA"}, {"criteria": "cpe:2.3:a:cisco:wide_area_application_services:6.4\\(3b\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA4D5F6B-B677-4BF9-8098-8E1314920164"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}