CVE-2020-3236— Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability

Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability

A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to gain root shell access to the underlying operating system and overwrite or read arbitrary files. The attacker would need valid administrative credentials. This vulnerability is due to improper input validation of CLI command arguments. An attacker could exploit this vulnerability by using path traversal techniques when executing a vulnerable command. A successful exploit could allow the attacker to gain root shell access to the underlying operating system and overwrite or read arbitrary files on an affected device.

N/A

对路径名的限制不恰当(路径遍历)

Cisco Enterprise NFV Infrastructure Software 路径遍历漏洞

Cisco Enterprise NFV Infrastructure Software（NFVIS）是美国思科（Cisco）公司的一套NVF基础架构软件平台。该平台可以通过中央协调器和控制器实现虚拟化服务的全生命周期管理。 Cisco Enterprise NFVIS Release 4.1.1之前版本中的CLI存在路径遍历漏洞，该漏洞源于程序没有正确对CLI命令参数进行正确的输入验证。本地攻击者可利用该漏洞获取底层操作系统的root shell的访问权限，覆盖或读取任意文件。

N/A

N/A