CVE-2019-1863

EPSS 0.08%
Veröffentlicht 21.08.2019 19:15:14
Zuletzt bearbeitet 21.11.2024 04:37:33
Quelle psirt@cisco.com
Teams Watchlist Login
Unerledigt Login

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to make unauthorized changes to the system configuration. The vulnerability is due to insufficient authorization enforcement. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow a user with read-only privileges to change critical system configurations using administrator privileges.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Cisco ≫ Unified Computing System Version4.0(1c)hs3

Cisco ≫ Integrated Management Controller Supervisor Version >= 1.5.0.0 < 1.5\(9g\)

   Cisco ≫ Encs 5100 Version-
   Cisco ≫ Encs 5400 Version-
   Cisco ≫ Ucs-e1120d-m3 Version-
   Cisco ≫ Ucs-e140s-m2 Version-
   Cisco ≫ Ucs-e160d-m2 Version-
   Cisco ≫ Ucs-e160s-m3 Version-
   Cisco ≫ Ucs-e168d-m2 Version-
   Cisco ≫ Ucs-e180d-m3 Version-
   Cisco ≫ Ucs C125 M5 Version-
   Cisco ≫ Ucs C4200 Version-
   Cisco ≫ Ucs S3260 Version-

Cisco ≫ Integrated Management Controller Supervisor Version >= 2.0.0.0 < 2.0\(13o\)

Cisco ≫ Integrated Management Controller Supervisor Version >= 3.0.0.0 < 3.0\(4k\)

Cisco ≫ Integrated Management Controller Supervisor Version >= 4.0.0.0 < 4.0\(4b\)

Cisco ≫ Integrated Management Controller Supervisor Version >= 4.0.0.0 < 4.0\(1d\)

Cisco ≫ Integrated Management Controller Supervisor Version >= 4.0.0.0 < 4.0\(2c\)

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.08%	0.197

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	8.1	2.8	5.2	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
nvd@nist.gov	9	8	10	AV:N/AC:L/Au:S/C:C/I:C/A:C
psirt@cisco.com	6.5	2.8	3.6	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE-285 Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imc-privilege

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-1863

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-1863

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-1863

EUVD