CVE-2019-1807 Cisco Umbrella Dashboard Session Management Vulnerability
An attacker can maintain unauthorized access to the Cisco Umbrella Dashboard by exploiting a session management flaw that fails to invalidate sessions upon credential changes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-1807?
CVE-2019-1807 is a high-severity authentication bypass vulnerability in Cisco Umbrella, published on 3 May 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A vulnerability in the session management functionality of the web UI for the Cisco Umbrella Dashboard could allow an authenticated, remote attacker to access the Dashboard via an active, user session. The vulnerability exists due to the affected application not invalidating an existing session when a user authenticates to the application and changes the users credentials via another authenticated session. An attacker could exploit this vulnerability by using a separate, authenticated, active session to connect to the application through the web UI. A successful exploit could allow the attacker to maintain access to the dashboard via an authenticated user's browser session. Cisco has addressed this vulnerability in the Cisco Umbrella Dashboard. No user action is required.
Weakness: CWE-384
Which versions are affected by CVE-2019-1807?
It affects 1 product.
Products include Cisco Umbrella.
How do I fix CVE-2019-1807?
No fix has been published for CVE-2019-1807 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-1807 being exploited?
There is no known exploitation of CVE-2019-1807 in the wild and no public exploit code.
Other vulnerabilities in Cisco Umbrella
- CVE-2018-0435 Cisco Umbrella API Unauthorized Access Vulnerability
- CVE-2021-1474 Cisco Umbrella Link and CSV Formula Injection Vulnerabilities
- CVE-2021-1475 Cisco Umbrella Link and CSV Formula Injection Vulnerabilities
- CVE-2019-1792 Cisco Umbrella Cross-Site Scripting Vulnerability
- CVE-2021-1350 Cisco Umbrella Dashboard Packet Flood Vulnerability
Sources
Also known as GHSA-6vf3-jgh6-2pvc.