{"id":"CVE-2019-1819","aliases":["EUVD-2019-10376","GHSA-rxw5-q35g-8ph9","MGASA-2020-0123"],"status":"published","title":"Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability","description":"A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.13611,"percentile":0.96496,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2019-05-16T01:10:52Z","modified":"2026-06-17T02:29:22Z","affected":[{"source":"osv","ecosystem":"Mageia:7","package":"chromium-browser-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"80.0.3987.122-1.mga7"}]}],"bundled":41},{"source":"osv","ecosystem":"Mageia:7","package":"icu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"63.1-1.2.mga7"}]}],"bundled":41}],"products":[{"vendor":"cisco","product":"cisco prime infrastructure"},{"vendor":"cisco","product":"evolved_programmable_network_manager"},{"vendor":"cisco","product":"prime_infrastructure"}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-pathtrav-1819","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/108351","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1819"},{"url":"https://github.com/advisories/GHSA-rxw5-q35g-8ph9"},{"url":"https://advisories.mageia.org/MGASA-2020-0123.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26269","tags":["report"]},{"url":"https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html","tags":["web"]},{"url":"https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_11.html","tags":["web"]},{"url":"https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_13.html","tags":["web"]},{"url":"https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_18.html","tags":["web"]},{"url":"https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_24.html","tags":["web"]},{"url":"https://unicode-org.atlassian.net/browse/ICU-20958","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-1819","title":"Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability","description":"A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information.","status":"published","published":"2019-05-16T01:10:52.27Z","modified":"2024-11-21T19:24:55.928Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:25.661187Z"}],"euvd":[{"id":"EUVD-2019-10376","description":"A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information.","status":"published","published":"2019-05-16T01:10:52Z","modified":"2024-11-21T19:24:55Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:51.735192Z"}],"ghsa":[{"id":"GHSA-rxw5-q35g-8ph9","title":"A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco...","description":"A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information.","status":"published","published":"2022-05-24T16:45:56Z","modified":"2023-04-01T05:06:55Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:54:26.249885Z"}],"nvd":[{"id":"CVE-2019-1819","description":"A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information.","status":"published","published":"2019-05-16T01:29:00.36Z","modified":"2026-06-17T02:29:22.92Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:13.880207Z"}],"osv":[{"id":"MGASA-2020-0123","title":"Updated chromium-browser-stable packages fix security vulnerabilities","description":"Chromium-browser 80.0.3987.122 fixes security issues:\n\nMultiple flaws were found in the way Chromium 79.0.3945.130 processes\nvarious types of web content, where loading a web page containing malicious\ncontent could cause Chromium to crash, execute arbitrary code, or disclose\nsensitive information. (CVE-2020-6381, CVE-2020-6382, CVE-2020-6383,\nCVE-2020-6384, CVE-2020-6385, CVE-2020-6386, CVE-2020-6387, CVE-2020-6388,\nCVE-2020-6389, CVE-2020-6390, CVE-2020-6391, CVE-2020-6392, CVE-2020-6393,\nCVE-2020-6394, CVE-2020-6395, CVE-2020-6396, CVE-2020-6397, CVE-2020-6398,\nCVE-2020-6399, CVE-2020-6400, CVE-2020-6401, CVE-2020-6402, CVE-2020-6403,\nCVE-2020-6404, CVE-2020-6405, CVE-2020-6406, CVE-2020-6407, CVE-2020-6408,\nCVE-2020-6409, CVE-2020-6410, CVE-2020-6411, CVE-2020-6412, CVE-2020-6413,\nCVE-2020-6414, CVE-2020-6415, CVE-2020-6416, CVE-2020-6418, CVE-2019-18197,\nCVE-2019-19923, CVE-2019-19925, CVE-2019-19926)\n\nUpstream chromium 80.0.3987.122 also includes a fix for an integer overflow\nissue in ICU. Since the chromium-browser-stable package is linked against\nthe icu packages instead of using the ICU source code bundled with chromium\nupstream, this issue is fixed in the icu package.\n","status":"published","published":"2020-03-06T16:13:58Z","modified":"2026-04-16T04:42:09.458375687Z","updated_at":"2026-11-02T15:49:41.151324Z"}]}}