Path traversal in Cisco Secure Firewall Management Center (formerly Firepower Management Center, FMC) - CVE-2019-12691
Published: October 8, 2019
Vulnerability identifier: #VU21627
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-12691
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error by the web-based management interface when processing directory traversal sequences. A remote authenticated attacker can send a specially crafted HTTP request to the web-based management interface, bypass security restrictions and gain access to the underlying filesystem of the affected device.
Affected software
Cisco Secure Firewall Management Center (formerly Firepower Management Center, FMC)
How to mitigate CVE-2019-12691
Install updates from vendor's website.
Cisco Secure Firewall Management Center (formerly Firepower Management Center, FMC) - update to 6.2.3