Details of VAR-202001-0784

ID

VAR-202001-0784

CVE

CVE-2019-15984

TITLE

Cisco Data Center Network Manager getSwitchDbIdBySerialNumber SQL Injection Remote Code Execution Vulnerability

Trust: 0.7

sources: ZDI: ZDI-20-110

DESCRIPTION

Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. To exploit these vulnerabilities, an attacker would need administrative privileges on the DCNM application. For more information about these vulnerabilities, see the Details section of this advisory. Note: The severity of these vulnerabilities is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the processing of requests to the jobs endpoint. When parsing the filterStr parameter in the getJobLength method, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker could leverage this vulnerability to disclose stored credentials, leading to further compromise. The vulnerability stems from insufficient input validation provided by the user to the API

Trust: 12.78

sources: NVD: CVE-2019-15984 // ZDI: ZDI-20-020 // ZDI: ZDI-20-037 // ZDI: ZDI-20-097 // ZDI: ZDI-20-027 // ZDI: ZDI-20-077 // ZDI: ZDI-20-067 // ZDI: ZDI-20-090 // ZDI: ZDI-20-057 // ZDI: ZDI-20-110 // ZDI: ZDI-20-017 // ZDI: ZDI-20-047 // ZDI: ZDI-20-107 // ZDI: ZDI-20-106 // ZDI: ZDI-20-038 // ZDI: ZDI-20-085 // ZDI: ZDI-20-096 // ZDI: ZDI-20-099 // ZDI: ZDI-20-087 // CNVD: CNVD-2020-00281

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-00281

AFFECTED PRODUCTS

vendor:	cisco	model:	data center network manager	scope:	-	version:	-	Trust: 12.6
vendor:	cisco	model:	data center network manager	scope:	lt	version:	11.3\(1\)	Trust: 1.0
vendor:	cisco	model:	data center network manager	scope:	lt	version:	11.3(1)	Trust: 0.6

sources: ZDI: ZDI-20-110 // ZDI: ZDI-20-020 // ZDI: ZDI-20-099 // ZDI: ZDI-20-096 // ZDI: ZDI-20-085 // ZDI: ZDI-20-038 // ZDI: ZDI-20-106 // ZDI: ZDI-20-107 // ZDI: ZDI-20-047 // ZDI: ZDI-20-017 // ZDI: ZDI-20-087 // ZDI: ZDI-20-057 // ZDI: ZDI-20-090 // ZDI: ZDI-20-067 // ZDI: ZDI-20-077 // ZDI: ZDI-20-027 // ZDI: ZDI-20-097 // ZDI: ZDI-20-037 // CNVD: CNVD-2020-00281 // NVD: CVE-2019-15984

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI:	CVE-2019-15984
value:	HIGH
Trust: 11.2
ZDI:	CVE-2019-15984
value:	MEDIUM
Trust: 1.4
nvd@nist.gov:	CVE-2019-15984
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-15984
value:	HIGH
Trust: 1.0
CNVD:	CNVD-2020-00281
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2019-15984
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
CNVD:	CNVD-2020-00281
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

ZDI:	CVE-2019-15984
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 9.1
ZDI:	CVE-2019-15984
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.0
Trust: 2.1
ZDI:	CVE-2019-15984
baseSeverity:	MEDIUM
baseScore:	4.9
vectorString:	AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	1.2
impactScore:	3.6
version:	3.0
Trust: 1.4
nvd@nist.gov:	CVE-2019-15984
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.1
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-15984
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.0
Trust: 1.0

PROBLEMTYPE DATA

problemtype:

CWE-89

Trust: 1.0

sources: NVD: CVE-2019-15984

PATCH

title:	Cisco has issued an update to correct this vulnerability.	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-sql-inject	Trust: 12.6
title:	Patch for Cisco Data Center Network Manager REST API SQL Injection Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/195959	Trust: 0.6

EXTERNAL IDS

db:	NVD	id:	CVE-2019-15984	Trust: 14.2
db:	PACKETSTORM	id:	156239	Trust: 1.0
db:	ZDI_CAN	id:	ZDI-CAN-9352	Trust: 0.7
db:	ZDI	id:	ZDI-20-110	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9043	Trust: 0.7
db:	ZDI	id:	ZDI-20-020	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9301	Trust: 0.7
db:	ZDI	id:	ZDI-20-099	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9283	Trust: 0.7
db:	ZDI	id:	ZDI-20-096	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9208	Trust: 0.7
db:	ZDI	id:	ZDI-20-085	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9182	Trust: 0.7
db:	ZDI	id:	ZDI-20-038	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9348	Trust: 0.7
db:	ZDI	id:	ZDI-20-106	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9349	Trust: 0.7
db:	ZDI	id:	ZDI-20-107	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9059	Trust: 0.7
db:	ZDI	id:	ZDI-20-047	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9030	Trust: 0.7
db:	ZDI	id:	ZDI-20-017	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9210	Trust: 0.7
db:	ZDI	id:	ZDI-20-087	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9164	Trust: 0.7
db:	ZDI	id:	ZDI-20-057	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9216	Trust: 0.7
db:	ZDI	id:	ZDI-20-090	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9185	Trust: 0.7
db:	ZDI	id:	ZDI-20-067	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9197	Trust: 0.7
db:	ZDI	id:	ZDI-20-077	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9062	Trust: 0.7
db:	ZDI	id:	ZDI-20-027	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9289	Trust: 0.7
db:	ZDI	id:	ZDI-20-097	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9184	Trust: 0.7
db:	ZDI	id:	ZDI-20-037	Trust: 0.7
db:	CNVD	id:	CNVD-2020-00281	Trust: 0.6

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20200102-dcnm-sql-inject	Trust: 14.2
url:	http://packetstormsecurity.com/files/156239/cisco-data-center-network-manager-11.2.1-sql-injection.html	Trust: 1.0

CREDITS

Steven Seeley (mr_me) of Source Incite

Trust: 12.6

SOURCES

db:	ZDI	id:	ZDI-20-110
db:	ZDI	id:	ZDI-20-020
db:	ZDI	id:	ZDI-20-099
db:	ZDI	id:	ZDI-20-096
db:	ZDI	id:	ZDI-20-085
db:	ZDI	id:	ZDI-20-038
db:	ZDI	id:	ZDI-20-106
db:	ZDI	id:	ZDI-20-107
db:	ZDI	id:	ZDI-20-047
db:	ZDI	id:	ZDI-20-017
db:	ZDI	id:	ZDI-20-087
db:	ZDI	id:	ZDI-20-057
db:	ZDI	id:	ZDI-20-090
db:	ZDI	id:	ZDI-20-067
db:	ZDI	id:	ZDI-20-077
db:	ZDI	id:	ZDI-20-027
db:	ZDI	id:	ZDI-20-097
db:	ZDI	id:	ZDI-20-037
db:	CNVD	id:	CNVD-2020-00281
db:	NVD	id:	CVE-2019-15984

LAST UPDATE DATE

2026-04-14T23:40:48.532000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-20-110	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-020	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-099	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-096	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-085	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-038	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-106	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-107	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-047	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-017	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-087	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-057	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-090	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-067	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-077	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-027	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-097	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-037	date:	2020-01-03T00:00:00
db:	CNVD	id:	CNVD-2020-00281	date:	2020-01-03T00:00:00
db:	NVD	id:	CVE-2019-15984	date:	2024-11-21T04:29:52.267

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-20-110	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-020	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-099	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-096	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-085	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-038	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-106	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-107	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-047	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-017	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-087	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-057	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-090	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-067	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-077	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-027	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-097	date:	2020-01-03T00:00:00
db:	ZDI	id:	ZDI-20-037	date:	2020-01-03T00:00:00
db:	CNVD	id:	CNVD-2020-00281	date:	2020-01-03T00:00:00
db:	NVD	id:	CVE-2019-15984	date:	2020-01-06T08:15:11.440