CVE-2019-1794: cisco cisco directory connector Uncontrolled Search Path Element

Vulnerability summary

CVE-2019-1794 is a medium (CVSS 5.1) Uncontrolled Search Path Element vulnerability in cisco cisco directory connector. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 31.1% of scored vulnerabilities.

Timeline

1. 18-04-2019
   PublishedVulnerability first disclosed.
2. 21-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the search path processing of Cisco Directory Connector could allow an authenticated, local attacker to load a binary of their choosing. The vulnerability is due to uncontrolled search path elements. An attacker could exploit this vulnerability by placing a binary of their choosing earlier in the search path utilized by Cisco Directory Connector to locate and load required resources.

• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.