{"id":"CVE-2019-1867","state":"PUBLISHED","title":"Cisco Elastic Services Controller REST API Authentication Bypass Vulnerability","description":"A vulnerability in the REST API of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to bypass authentication on the REST API. The vulnerability is due to improper validation of API requests. An attacker could exploit this vulnerability by sending a crafted request to the REST API. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on an affected system.","publishedAt":"2019-05-10T12:05:18.232Z","updatedAt":"2024-11-19T19:07:39.653Z","severity":{"score":10,"label":"Critical","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"cisco"},"assigner":"cisco","products":["Cisco Cisco Elastic Services Controller"],"affected":[{"vendor":"Cisco","product":"Cisco Elastic Services Controller","versions":[{"version":"unspecified","status":"affected","lessThan":"4.1.0.100","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"4.2.0.74","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"4.3.0.121","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"4.4.0.80","versionType":"custom"}]}],"references":["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190507-esc-authbypass"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T19:45:46.792Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/1xxx/CVE-2019-1867.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2019-1867","state":"PUBLISHED","datePublished":"2019-05-10T12:05:18.232Z","dateUpdated":"2024-11-19T19:07:39.653Z","assignerShortName":"cisco","assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateReserved":"2018-12-06T00:00:00.000Z"},"containers":{"cna":{"title":"Cisco Elastic Services Controller REST API Authentication Bypass Vulnerability","descriptions":[{"lang":"en","value":"A vulnerability in the REST API of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to bypass authentication on the REST API. The vulnerability is due to improper validation of API requests. An attacker could exploit this vulnerability by sending a crafted request to the REST API. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on an affected system."}],"affected":[{"vendor":"Cisco","product":"Cisco Elastic Services Controller","versions":[{"version":"unspecified","status":"affected","lessThan":"4.1.0.100","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"4.2.0.74","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"4.3.0.121","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"4.4.0.80","versionType":"custom"}]}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190507-esc-authbypass","name":"20190507 Cisco Elastic Services Controller REST API Authentication Bypass Vulnerability","tags":["vendor-advisory","x_refsource_CISCO"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","description":"CWE-287","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"cisco","dateUpdated":"2019-05-10T12:05:18.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633"},"datePublic":"2019-05-07T00:00:00.000Z","exploits":[{"lang":"en","value":"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}],"source":{"advisory":"cisco-sa-20190507-esc-authbypass","defect":[["CSCvn82921"]],"discovery":"INTERNAL"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","DATE_PUBLIC":"2019-05-07T16:00:00-0700","ID":"CVE-2019-1867","STATE":"PUBLIC","TITLE":"Cisco Elastic Services Controller REST API Authentication Bypass Vulnerability"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Cisco Elastic Services Controller","version":{"version_data":[{"affected":"<","version_affected":"<","version_value":"4.1.0.100"},{"affected":"<","version_affected":"<","version_value":"4.2.0.74"},{"affected":"<","version_affected":"<","version_value":"4.3.0.121"},{"affected":"<","version_affected":"<","version_value":"4.4.0.80"}]}}]},"vendor_name":"Cisco"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A vulnerability in the REST API of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to bypass authentication on the REST API. The vulnerability is due to improper validation of API requests. An attacker could exploit this vulnerability by sending a crafted request to the REST API. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on an affected system."}]},"exploit":[{"lang":"en","value":"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}],"impact":{"cvss":{"baseScore":"10.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-287"}]}]},"references":{"reference_data":[{"name":"20190507 Cisco Elastic Services Controller REST API Authentication Bypass Vulnerability","refsource":"CISCO","url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190507-esc-authbypass"}]},"source":{"advisory":"cisco-sa-20190507-esc-authbypass","defect":[["CSCvn82921"]],"discovery":"INTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190507-esc-authbypass","name":"20190507 Cisco Elastic Services Controller REST API Authentication Bypass Vulnerability","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T18:28:42.920Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-11-19T17:21:19.701145Z","id":"CVE-2019-1867","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-19T19:07:39.653Z"}}]}}}