// For flags

CVE-2019-1938

Cisco UCS Director and Cisco UCS Director Express for Big Data API Authentication Bypass Vulnerability

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

A vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The vulnerability is due to improper authentication request handling. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an unprivileged attacker to access and execute arbitrary actions through certain APIs.

Una vulnerabilidad en la interfaz de administración basada en la web de Cisco UCS Director y Cisco UCS Director Express para Big Data podría permitir que un atacante remoto no autenticado omita la autenticación y ejecute acciones arbitrarias con privilegios de administrador en un sistema afectado. La vulnerabilidad se debe al manejo incorrecto de la solicitud de autenticación. Un atacante podría aprovechar esta vulnerabilidad enviando solicitudes HTTP diseñadas a un dispositivo afectado. Un exploit exitoso podría permitir que un atacante sin privilegios acceda y ejecute acciones arbitrarias a través de ciertas API.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2018-12-06 CVE Reserved
  • 2019-08-21 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-11-19 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-287: Improper Authentication
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Ucs Director
Search vendor "Cisco" for product "Ucs Director"
 6.7.0.0
Search vendor "Cisco" for product "Ucs Director" and version "6.7.0.0"
-
Affected
Cisco
Search vendor "Cisco"
 Ucs Director
Search vendor "Cisco" for product "Ucs Director"
 6.7.1.0
Search vendor "Cisco" for product "Ucs Director" and version "6.7.1.0"
-
Affected
Cisco
Search vendor "Cisco"
 Ucs Director Express For Big Data
Search vendor "Cisco" for product "Ucs Director Express For Big Data"
 3.7.0.0
Search vendor "Cisco" for product "Ucs Director Express For Big Data" and version "3.7.0.0"
-
Affected
Cisco
Search vendor "Cisco"
 Ucs Director Express For Big Data
Search vendor "Cisco" for product "Ucs Director Express For Big Data"
 3.7.1.0
Search vendor "Cisco" for product "Ucs Director Express For Big Data" and version "3.7.1.0"
-
Affected