CVE-2019-1889

A vulnerability in the REST API for software device management in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an authenticated, remote attacker to escalate privileges to root on an affected device. The vulnerability is due to incomplete validation and error checking for the file path when specific software is uploaded. An attacker could exploit this vulnerability by uploading malicious software using the REST API. A successful exploit could allow an attacker to escalate their privilege level to root. The attacker would need to have the administrator role on the device.

• CWE-264
• CWE-20

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-ccapic-restapiVendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-ccapic-restapiVendor Advisory

Published

Jul 4, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18884index.php/team_members/add_team_member in RISE Ultimate Proj…8.8
• CVE-2019-18885fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a b…5.5
• CVE-2019-18886An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0…5.3
• CVE-2019-18887An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4…8.1
• CVE-2019-18888An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4…7.5
• CVE-2019-18889An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2…9.8
• CVE-2019-18890A SQL injection vulnerability in Redmine through 3.2.9 and 3…6.5
• CVE-2019-18893XSS in the Video Downloader component before 1.5 of Avast Se…6.1
• CVE-2019-18894In Avast Premium Security 19.8.2393, attackers can send a sp…7.8
• CVE-2019-18895Scanguard through 2019-11-12 on Windows has Insecure Permiss…7.8
• CVE-2019-18897A UNIX Symbolic Link (Symlink) Following vulnerability in th…7.8
• CVE-2019-18898UNIX Symbolic Link (Symlink) Following vulnerability in the …7.8