PT-2018-8619 · Cisco · Cisco Ucs Central

Publicado 2018-02-08 · Atualizado 2019-10-09 · CVE-2018-0113

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco UCS Central Software versions prior to 2.0(1c)

Description: A vulnerability in the operations script of Cisco UCS Central could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the daemon user. This issue is due to insufficient input validation. An attacker could exploit this by posting a crafted request to the "user interface" of Cisco UCS Central.

Recommendations: For versions prior to 2.0(1c), update to Release 2.0(1c) or later to resolve the issue. As a temporary workaround, consider restricting access to the user interface of Cisco UCS Central to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-0113

Produtos afetados

Cisco Ucs Central

Referências · 5

• http://securityfocus.com/bid/102966 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-ucsc · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-0113 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-0113 · Aviso do Fabricante
• http://securitytracker.com/id/1040337 · Nota