PT-2016-1744 · Cisco · Cisco Unified Computing System (Ucs) Central

Publicado 2016-04-14 · Atualizado 2016-12-03 · CVE-2016-1352

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System (UCS) Central Software versions 1.3(1b) and earlier

Description The issue allows remote attackers to execute arbitrary OS commands via a crafted HTTP request. This is due to the system's failure to neutralize special elements used in the OS command. Exploitation of the issue may allow a remote attacker to execute arbitrary OS commands using a specially crafted HTTP request.

Recommendations For Cisco Unified Computing System (UCS) Central Software versions 1.3(1b) and earlier, update to a version later than 1.3(1b) to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2016-01070

CVE-2016-1352

Produtos afetados

Cisco Unified Computing System (Ucs) Central

Referências · 5

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160413-ucs · Aviso do Fabricante
• http://securitytracker.com/id/1035565 · Nota
• https://bdu.fstec.ru/vul/2016-01070 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-1352 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1352 · Nota de Segurança