CVE Vulnerability

CVE-2019-1853

A vulnerability in the HostScan component of Cisco AnyConnect Secure Mobility Client for Linux could allow an unauthenticated, remote attacker to read sensitive information on an affected system. The vulnerability exists because the affected software performs improper bounds checks. An attacker could exploit this vulnerability by crafting HTTP traffic for the affected component to download and process. A successful exploit could allow the attacker to read sensitive information on the affected system.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-anyconnectclient-oob-read Vendor Advisory
http://www.securityfocus.com/bid/108364 Third Party Advisory VDB Entry
Configurations

Configuration 1

cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.6(2074):*:*:*:*:*:*:*
Information

Published : 2019-05-16 02:29

Updated : 2019-10-09 11:48

NVD link : CVE-2019-1853

Mitre link : CVE-2019-1853

Products Affected
No products.
CWE
CWE-125

Out-of-bounds Read