CVE-2019-1621

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to gain access to sensitive files on an affected device. The vulnerability is due to incorrect permissions settings on affected DCNM software. An attacker could exploit this vulnerability by connecting to the web-based management interface of an affected device and requesting specific URLs. A successful exploit could allow the attacker to download arbitrary files from the underlying filesystem of the affected device.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-264 CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jun 27, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-162105.5Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save.CVE-2019-162119.8Brocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability.CVE-2019-162128.8A vulnerability in Brocade SANnav versions before v2.1.0 could allow a remote authenticated attacker to conduct an LDAP injection. The vulne CVE-2019-162138.8Tenda PA6 Wi-Fi Powerline extender 1.0.1.21 could allow a remote authenticated attacker to execute arbitrary commands on the system. By send CVE-2019-162145.7Libra Core before 2019-09-03 has an erroneous regular expression for inline comments, which makes it easier for attackers to interfere with CVE-2019-162156.5The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into CVE-2019-162165.4Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files o CVE-2019-162176.1WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.CVE-2019-162186.1WordPress before 5.2.3 allows XSS in stored comments.CVE-2019-162196.1WordPress before 5.2.3 allows XSS in shortcode previews.CVE-2019-16225.3A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote att CVE-2019-162206.1In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open r