PT-2018-8692 · Cisco · Cisco Unified Computing System (Ucs) Director

Publicado 2018-04-19 · Atualizado 2019-10-09 · CVE-2018-0238

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco Unified Computing System (UCS) Director versions 6.0 through 6.5 prior to patch 3

Description: A vulnerability in the role-based resource checking functionality could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal and perform any permitted operations on any virtual machine. The vulnerability is due to improper user authentication checks. An attacker could exploit this vulnerability by logging in to the UCS Director with a modified username and valid password. A successful exploit could allow the attacker to gain visibility into and perform actions against all virtual machines in the UCS Director end-user portal of the affected system.

Recommendations: For Cisco Unified Computing System (UCS) Director versions 6.0 through 6.5 prior to patch 3, apply patch 3 to resolve the issue. As a temporary workaround, consider restricting access to the UCS Director end-user portal to minimize the risk of exploitation. Additionally, review and restrict VM Management Actions settings configured under User Permissions to limit the actions that can be performed on virtual machines.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2018-0238

Produtos afetados

Cisco Unified Computing System (Ucs) Director

Referências · 5

• http://securitytracker.com/id/1040708 · Nota
• https://osv.dev/vulnerability/CVE-2018-0238 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-0238 · Nota de Segurança
• http://securityfocus.com/bid/103919 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-uscd · Aviso do Fabricante