CVE-2015-0666 : Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Ce

Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) allows remote attackers to read arbitrary files via a crafted pathname, aka Bug ID CSCus00241.

Published 2015-04-03 10:59:04

Updated 2015-09-29 19:31:23

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Directory traversal

Products affected by CVE-2015-0666

Cisco » Prime Data Center Network Manager
Versions up to, including, (<=) 7.0\(2\)
cpe:2.3:a:cisco:prime_data_center_network_manager:*:*:*:*:*:*:*:*
Matching versions
Cisco » Prime Data Center Network Manager » Version: 6.3(1)
cpe:2.3:a:cisco:prime_data_center_network_manager:6.3\(1\):*:*:*:*:*:*:*
Matching versions
Cisco » Prime Data Center Network Manager » Version: 7.0(1)
cpe:2.3:a:cisco:prime_data_center_network_manager:7.0\(1\):*:*:*:*:*:*:*
Matching versions
Cisco » Prime Data Center Network Manager » Version: 6.3(2)
cpe:2.3:a:cisco:prime_data_center_network_manager:6.3\(2\):*:*:*:*:*:*:*
Matching versions

CVE-2015-0666 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) allows remote attackers to read arbitrary files.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2015-0666

Added on 2022-03-25 Action due date 2022-04-15

Exploit prediction scoring system (EPSS) score for CVE-2015-0666

EPSS FAQ

97.35%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-0666

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.8	HIGH	AV:N/AC:L/Au:N/C:C/I:N/A:N	10.0	6.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: None Availability Impact: None

CWE ids for CVE-2015-0666

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-0666

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150401-dcnm

Cisco Prime Data Center Network Manager File Information Disclosure Vulnerability
Vendor Advisory
http://www.securitytracker.com/id/1032009

Cisco Prime Data Center Network Manager Directory Traversal Bug Lets Remote Users Obtain Arbitrary Files - SecurityTracker