CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-3817
https://notcve.org/view.php?id=CVE-2017-3817
07 Apr 2017 — A vulnerability in the role-based resource checking functionality of Cisco Unified Computing System (UCS) Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in a UCS domain. More Information: CSCvc32434. Known Affected Releases: 5.5(0.1) 6.0(0.0). Una vulnerabilidad en la funcionalidad de comprobación de recursos basada en roles del Director del Unified Computing System (UCS) de Cisco podría permitir a un atacante remoto autenticado ver informació... • http://www.securityfocus.com/bid/97430 • CWE-863: Incorrect Authorization •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-3801
https://notcve.org/view.php?id=CVE-2017-3801
15 Feb 2017 — A vulnerability in the web-based GUI of Cisco UCS Director 6.0.0.0 and 6.0.0.1 could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile, a Privilege Escalation Vulnerability. The vulnerability is due to improper role-based access control (RBAC) after the Developer Menu is enabled in Cisco UCS Director. An attacker could exploit this vulnerability by enabling Developer Mode for his/her user profile with an end-user profile and then adding new catalogs wit... • http://www.securityfocus.com/bid/96235 • CWE-264: Permissions, Privileges, and Access Controls CWE-863: Incorrect Authorization •