CVE-2013-1182
The login page in the Web Console in the Manager component in Cisco Unified Computing System (UCS) before 1.0(2h), 1.1 before 1.1(1j), and 1.3(x) allows remote attackers to bypass LDAP authentication via a malformed request, aka Bug ID CSCtc91207.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.51%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The login page in the Web Console in the Manager component in Cisco Unified Computing System (UCS) before 1.0(2h), 1.1 before 1.1(1j), and 1.3(x) allows remote attackers to bypass LDAP authentication via a malformed request, aka Bug ID CSCtc91207.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 3.51% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- cisco/unified computing system infrastructure and unified computing system software · cisco/unified computing system 6120xp fabric interconnect · cisco/unified computing system 6140xp fabric interconnect · cisco/unified computing system 6248up fabric interconnect · cisco/unified computing system 6296up fabric interconnect · cisco/unified computing system integrated management controller
- Source
- psirt@cisco.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.