VulnerabilityModified

CVE-2019-16003

A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to download system log files from an affected device.

MEDIUM 5.3EPSS 1.22%

Does this matter?

Lower severity and a low EPSS score (1.22%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to download system log files from an affected device. The vulnerability is due to an issue in the authentication logic of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web interface. A successful exploit could allow the attacker to download log files if they were previously generated by an administrator.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 1.22% probability · 67th percentile
CISA KEV: Not listed
Weakness: CWE-306
Affected: cisco/ucs director
Source: psirt@cisco.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.