PT-2020-1431 · Cisco · Cisco Ucs Director

Published 2020-01-08 · Updated 2020-01-27 · CVE-2019-16003

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco UCS Director (affected versions not specified)

Description A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to download system log files from an affected device. The issue is due to a problem in the authentication logic of the web-based management interface. An attacker could exploit this by sending a crafted request to the web interface, potentially allowing them to download log files if they were previously generated by an administrator. The vulnerability is related to the lack of authentication for a critical function, which could enable a remote attacker to disclose protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2020-00409

CVE-2019-16003

Affected Products

Cisco Ucs Director

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-ucs-dir-infodis · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16003 · Security Note
• https://bdu.fstec.ru/vul/2020-00409 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16003 · Vendor Advisory
• https://t.me/cvenotify/407 · Telegram Post