PT-2018-8692 · Cisco · Cisco Unified Computing System (Ucs) Director

Published 2018-04-19 · Updated 2019-10-09 · CVE-2018-0238

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco Unified Computing System (UCS) Director versions 6.0 through 6.5 prior to patch 3

Description: A vulnerability in the role-based resource checking functionality could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal and perform any permitted operations on any virtual machine. The vulnerability is due to improper user authentication checks. An attacker could exploit this vulnerability by logging in to the UCS Director with a modified username and valid password. A successful exploit could allow the attacker to gain visibility into and perform actions against all virtual machines in the UCS Director end-user portal of the affected system.

Recommendations: For Cisco Unified Computing System (UCS) Director versions 6.0 through 6.5 prior to patch 3, apply patch 3 to resolve the issue. As a temporary workaround, consider restricting access to the UCS Director end-user portal to minimize the risk of exploitation. Additionally, review and restrict VM Management Actions settings configured under User Permissions to limit the actions that can be performed on virtual machines.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-0238

Affected Products

Cisco Unified Computing System (Ucs) Director

References · 5

• https://osv.dev/vulnerability/CVE-2018-0238 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0238 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-uscd · Vendor Advisory
• http://securitytracker.com/id/1040708 · Note
• http://securityfocus.com/bid/103919 · Note