Details of VAR-201412-0305

ID

VAR-201412-0305

CVE

CVE-2014-8019

TITLE

Cisco Enterprise Content Delivery System Vulnerable to directory traversal

Trust: 0.8

sources: JVNDB: JVNDB-2014-007372

DESCRIPTION

Directory traversal vulnerability in Cisco Enterprise Content Delivery System (ECDS) allows remote attackers to read arbitrary files via a crafted URL, aka Bug ID CSCuo90148. An attacker can exploit this issue to access arbitrary files in the context of the web server process, which may aid in further attacks. This issue is being tracked by Cisco Bug ID CSCuo90148. The system consists of a variety of video transmission products, hardware devices and Cisco Wide Area Application Services (WAAS) virtual blade software, which can help enterprises transmit real-time video content through streaming or multicast, and support setup, configuration, maintenance and monitoring of video

Trust: 2.07

sources: NVD: CVE-2014-8019 // JVNDB: JVNDB-2014-007372 // BID: 71764 // VULHUB: VHN-75964 // VULMON: CVE-2014-8019

AFFECTED PRODUCTS

vendor:	cisco	model:	enterprise content delivery system	scope:	eq	version:	-	Trust: 1.6
vendor:	cisco	model:	enterprise content delivery system	scope:	eq	version:	2.5	Trust: 0.8

sources: JVNDB: JVNDB-2014-007372 // CNNVD: CNNVD-201412-452 // NVD: CVE-2014-8019

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-8019
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2014-8019
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201412-452
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-75964
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2014-8019
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2014-8019
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-75964
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-75964 // VULMON: CVE-2014-8019 // JVNDB: JVNDB-2014-007372 // CNNVD: CNNVD-201412-452 // NVD: CVE-2014-8019

PROBLEMTYPE DATA

problemtype:

CWE-22

Trust: 1.9

sources: VULHUB: VHN-75964 // JVNDB: JVNDB-2014-007372 // NVD: CVE-2014-8019

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201412-452

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-201412-452

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-007372

PATCH

title:	Cisco Enterprise Content Delivery System Web Directory Traversal and Arbitrary File Access Vulnerability	url:	http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8019	Trust: 0.8
title:	36844	url:	http://tools.cisco.com/security/center/viewAlert.x?alertId=36844	Trust: 0.8
title:	Cisco: Cisco Enterprise Content Delivery System Web Directory Traversal and Arbitrary File Access Vulnerability	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=Cisco-SA-20141222-CVE-2014-8019	Trust: 0.1

sources: VULMON: CVE-2014-8019 // JVNDB: JVNDB-2014-007372

EXTERNAL IDS

db:	NVD	id:	CVE-2014-8019	Trust: 2.9
db:	SECTRACK	id:	1031417	Trust: 1.2
db:	JVNDB	id:	JVNDB-2014-007372	Trust: 0.8
db:	CNNVD	id:	CNNVD-201412-452	Trust: 0.7
db:	BID	id:	71764	Trust: 0.5
db:	VULHUB	id:	VHN-75964	Trust: 0.1
db:	VULMON	id:	CVE-2014-8019	Trust: 0.1

sources: VULHUB: VHN-75964 // VULMON: CVE-2014-8019 // BID: 71764 // JVNDB: JVNDB-2014-007372 // CNNVD: CNNVD-201412-452 // NVD: CVE-2014-8019

REFERENCES

url:	http://tools.cisco.com/security/center/content/ciscosecuritynotice/cve-2014-8019	Trust: 1.8
url:	http://www.securitytracker.com/id/1031417	Trust: 1.2
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-8019	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-8019	Trust: 0.8
url:	www.cisco.com	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/22.html	Trust: 0.1
url:	https://www.securityfocus.com/bid/71764	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20141222-cve-2014-8019	Trust: 0.1

sources: VULHUB: VHN-75964 // VULMON: CVE-2014-8019 // BID: 71764 // JVNDB: JVNDB-2014-007372 // CNNVD: CNNVD-201412-452 // NVD: CVE-2014-8019

CREDITS

Cisco

Trust: 0.3

sources: BID: 71764

SOURCES

db:	VULHUB	id:	VHN-75964
db:	VULMON	id:	CVE-2014-8019
db:	BID	id:	71764
db:	JVNDB	id:	JVNDB-2014-007372
db:	CNNVD	id:	CNNVD-201412-452
db:	NVD	id:	CVE-2014-8019

LAST UPDATE DATE

2025-04-12T23:34:05.418000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-75964	date:	2017-01-03T00:00:00
db:	VULMON	id:	CVE-2014-8019	date:	2017-01-03T00:00:00
db:	BID	id:	71764	date:	2014-12-24T00:58:00
db:	JVNDB	id:	JVNDB-2014-007372	date:	2014-12-24T00:00:00
db:	CNNVD	id:	CNNVD-201412-452	date:	2014-12-23T00:00:00
db:	NVD	id:	CVE-2014-8019	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-75964	date:	2014-12-20T00:00:00
db:	VULMON	id:	CVE-2014-8019	date:	2014-12-20T00:00:00
db:	BID	id:	71764	date:	2014-12-19T00:00:00
db:	JVNDB	id:	JVNDB-2014-007372	date:	2014-12-24T00:00:00
db:	CNNVD	id:	CNNVD-201412-452	date:	2014-12-23T00:00:00
db:	NVD	id:	CVE-2014-8019	date:	2014-12-20T00:59:02.460