Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Cisco Prime Infrastructure/EPN Manager web UI can expose files

CVE-2019-1818 · published 7 years ago
Summary

The web management interface in Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager may let a logged‑in remote user read files that should be private. The problem occurs because the system does not properly clean up file name inputs, allowing directory‑traversal tricks. Protect yourself by applying the vendor’s security update and limiting access to the management console to trusted users only.

What to do
  • Update cisco evolved_programmable_network_manager to version 3.0.1 or later.
  • Update cisco prime_infrastructure to version 3.4 or later.
Affected software
VendorProductAffected versions
cisco evolved_programmable_network_manager < 3.0.1
cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:*
cisco prime_infrastructure < 3.4
cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*
Original advisory text
A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to do...
A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
14% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published16 May 2019
Updated22 Oct 2026
First seen29 Sep 2026
Sources
CVE-2019-1818 · NVD
Track software like this
Free during beta