CVE-2019-14905CWE-20CWE-73
A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy…
High · published March 31, 2020
What it is
A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.
The record
Technical detail
- CVSS v3.0
- 7.3 · HIGH
- Vector
- CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.00713 · 53.1th percentile
- Weaknesses
- CWE-20 · Improper Input Validation; CWE-73 · External Control of File Name or Path
- Published
- 2020-03-31T16:20Z
EPSS history
Timeline
31 MAR 16:20Z
A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy…
cvelistv5