CVE-2015-6259
The JavaServer Pages (JSP) component in Cisco Integrated Management Controller (IMC) Supervisor before 1.0.0.1 and UCS Director (formerly Cloupia Unified Infrastructure Controller) before 5.2.0.1 allows remote attackers to write to arbitrary files via…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.82%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The JavaServer Pages (JSP) component in Cisco Integrated Management Controller (IMC) Supervisor before 1.0.0.1 and UCS Director (formerly Cloupia Unified Infrastructure Controller) before 5.2.0.1 allows remote attackers to write to arbitrary files via crafted HTTP requests, aka Bug IDs CSCus36435 and CSCus62625.
- CVSS 2.0
- 9.4 HIGHAV:N/AC:L/Au:N/C:N/I:C/A:C
- EPSS
- 2.82% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- cisco/integrated management controller supervisor · cisco/unified computing system director
- Source
- psirt@cisco.com
References
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150902-cimcsVendor Advisory
- http://www.securitytracker.com/id/1033451Third Party Advisory, VDB Entry
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150902-cimcsVendor Advisory
- http://www.securitytracker.com/id/1033451Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.