CVE-2019-1937
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 75.9%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing user authentication. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to use the acquired session token to gain full administrator access to the affected device.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 75.86% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- cisco/integrated management controller supervisor · cisco/ucs director · cisco/ucs director express for big data
- Source
- psirt@cisco.com
References
- http://packetstormsecurity.com/files/154239/Cisco-UCS-IMC-Supervisor-Authentication-Bypass-Command-Injection.htmlExploit, Third Party Advisory
- http://packetstormsecurity.com/files/154308/Cisco-UCS-Director-Unauthenticated-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/173531/Cisco-UCS-IMC-Supervisor-2.2.0.0-Authentication-Bypass.html
- http://seclists.org/fulldisclosure/2019/Aug/36
- https://seclists.org/bugtraq/2019/Aug/49Third Party Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-ucs-authbyVendor Advisory
- http://packetstormsecurity.com/files/154239/Cisco-UCS-IMC-Supervisor-Authentication-Bypass-Command-Injection.htmlExploit, Third Party Advisory
- http://packetstormsecurity.com/files/154308/Cisco-UCS-Director-Unauthenticated-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/173531/Cisco-UCS-IMC-Supervisor-2.2.0.0-Authentication-Bypass.html
- http://seclists.org/fulldisclosure/2019/Aug/36
- https://seclists.org/bugtraq/2019/Aug/49Third Party Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-ucs-authbyVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.