{"api_version":"1","generated_at":"2026-04-26T23:29:42+00:00","cve":"CVE-2019-1717","urls":{"html":"https://cve.report/CVE-2019-1717","api":"https://cve.report/api/cve/CVE-2019-1717.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-1717","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-1717"},"summary":{"title":"CVE-2019-1717","description":"A vulnerability in the web-based management interface of Cisco Video Surveillance Manager could allow an unauthenticated, remote attacker to access sensitive information. The vulnerability is due to improper validation of parameters handled by the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to an affected component. A successful exploit could allow the attacker to download arbitrary files from the affected device, which could contain sensitive information.","state":"PUBLIC","assigner":"psirt@cisco.com","published_at":"2019-05-15 17:29:00","updated_at":"2019-10-09 23:47:00"},"problem_types":["CWE-22"],"metrics":[],"references":[{"url":"http://www.securityfocus.com/bid/108336","name":"108336","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"Cisco Video Surveillance Manager CVE-2019-1717 Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-cvsm","name":"20190515 Cisco Video Surveillance Manager Web-Based Management Interface Information Disclosure Vulnerability","refsource":"CISCO","tags":["Vendor Advisory"],"title":"Cisco Video Surveillance Manager Web-Based Management Interface Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1717","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1717","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"1717","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"video_surveillance_manager","cpe6":"7.21","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"1717","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"video_surveillance_manager","cpe6":"7.21","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","DATE_PUBLIC":"2019-05-15T16:00:00-0700","ID":"CVE-2019-1717","STATE":"PUBLIC","TITLE":"Cisco Video Surveillance Manager Web-Based Management Interface Information Disclosure Vulnerability"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Cisco Video Surveillance Manager ","version":{"version_data":[{"affected":"<","version_value":"7.12.1"}]}}]},"vendor_name":"Cisco"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A vulnerability in the web-based management interface of Cisco Video Surveillance Manager could allow an unauthenticated, remote attacker to access sensitive information. The vulnerability is due to improper validation of parameters handled by the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to an affected component. A successful exploit could allow the attacker to download arbitrary files from the affected device, which could contain sensitive information."}]},"exploit":[{"lang":"eng","value":"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. "}],"impact":{"cvss":{"baseScore":"7.5","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N ","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-22"}]}]},"references":{"reference_data":[{"name":"20190515 Cisco Video Surveillance Manager Web-Based Management Interface Information Disclosure Vulnerability","refsource":"CISCO","url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-cvsm"},{"refsource":"BID","name":"108336","url":"http://www.securityfocus.com/bid/108336"}]},"source":{"advisory":"cisco-sa-20190515-cvsm","defect":[["CSCvo47618"]],"discovery":"INTERNAL"}},"nvd":{"publishedDate":"2019-05-15 17:29:00","lastModifiedDate":"2019-10-09 23:47:00","problem_types":["CWE-22"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:cisco:video_surveillance_manager:7.21:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"1717","Ordinal":"138500","Title":"CVE-2019-1717","CVE":"CVE-2019-1717","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"1717","Ordinal":"1","NoteData":"A vulnerability in the web-based management interface of Cisco Video Surveillance Manager could allow an unauthenticated, remote attacker to access sensitive information. The vulnerability is due to improper validation of parameters handled by the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to an affected component. A successful exploit could allow the attacker to download arbitrary files from the affected device, which could contain sensitive information.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"1717","Ordinal":"2","NoteData":"2019-05-15","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"1717","Ordinal":"3","NoteData":"2019-05-16","Type":"Other","Title":"Modified"}]}}}