CVE-2019-1863

EPSS 0.08%
Published 21.08.2019 19:15:14
Last modified 21.11.2024 04:37:33
Source psirt@cisco.com
Teams watchlist Login
Open Login

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to make unauthorized changes to the system configuration. The vulnerability is due to insufficient authorization enforcement. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow a user with read-only privileges to change critical system configurations using administrator privileges.

Affected products Warnungen 0 Metrics 4 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Cisco ≫ Unified Computing System Version4.0(1c)hs3

Cisco ≫ Integrated Management Controller Supervisor Version >= 1.5.0.0 < 1.5\(9g\)

   Cisco ≫ Encs 5100 Version-
   Cisco ≫ Encs 5400 Version-
   Cisco ≫ Ucs-e1120d-m3 Version-
   Cisco ≫ Ucs-e140s-m2 Version-
   Cisco ≫ Ucs-e160d-m2 Version-
   Cisco ≫ Ucs-e160s-m3 Version-
   Cisco ≫ Ucs-e168d-m2 Version-
   Cisco ≫ Ucs-e180d-m3 Version-
   Cisco ≫ Ucs C125 M5 Version-
   Cisco ≫ Ucs C4200 Version-
   Cisco ≫ Ucs S3260 Version-

Cisco ≫ Integrated Management Controller Supervisor Version >= 2.0.0.0 < 2.0\(13o\)

Cisco ≫ Integrated Management Controller Supervisor Version >= 3.0.0.0 < 3.0\(4k\)

Cisco ≫ Integrated Management Controller Supervisor Version >= 4.0.0.0 < 4.0\(4b\)

Cisco ≫ Integrated Management Controller Supervisor Version >= 4.0.0.0 < 4.0\(1d\)

Cisco ≫ Integrated Management Controller Supervisor Version >= 4.0.0.0 < 4.0\(2c\)

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.08%	0.197

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	8.1	2.8	5.2	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
nvd@nist.gov	9	8	10	AV:N/AC:L/Au:S/C:C/I:C/A:C
psirt@cisco.com	6.5	2.8	3.6	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE-285 Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imc-privilege

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-1863

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-1863

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-1863

EUVD