Vulnslist

Cisco vulnerabilities by product, model, software, and advisory.

Cisco UCS Director and Cisco UCS Director Express for Big Data API Authentication Bypass Vulnerability

cisco-sa-20190821-ucsd-authbypass · Critical · Published · Updated

A vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The vulnerability is due to improper authentication request handling. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an unprivileged attacker to access and execute arbitrary actions through certain APIs. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-ucsd-authbypass

Cisco advisory · CSAF JSON

Workarounds

There are no workarounds that address this vulnerability.

CVEsCVE-2019-1938
Cisco Bug IDsCSCvp69746
CVSS ScoreBase 9.8
Base 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X
Product Names From Source
Cisco UCS Director, Cisco Unified Computing System Director Express for Big Data

Related Products

Product CVE Evidence
Cisco Unified Computing System Director Express for Big Data CVE-2019-1938 Cisco OpenVuln
Cisco UCS Director CVE-2019-1938 Cisco OpenVuln