CVE-2019-1645CWE-200

Cisco Connected Mobile Experiences Information Disclosure Vulnerability

Medium · published January 24, 2019

CVSS v3.0
4.3
EPSS
1%
Percentile
43.3
In the wild
Unconfirmed
What it is

A vulnerability in the Cisco Connected Mobile Experiences (CMX) software could allow an unauthenticated, adjacent attacker to access sensitive data on an affected device. The vulnerability is due to a lack of input and validation checking mechanisms for certain GET requests to API's on an affected device. An attacker could exploit this vulnerability by sending HTTP GET requests to an affected device. An exploit could allow the attacker to use this information to conduct additional reconnaissance attacks.

The record
Technical detail
CVSS v3.0
4.3 · MEDIUM
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00519 · 43.3th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2019-01-24T15:00Z
EPSS history
Timeline
  • 24 JAN 15:00Z
    Cisco Connected Mobile Experiences Information Disclosure Vulnerability
    cvelistv5