PT-2020-2963 · Cisco · Cisco Ucs Director

Published 2020-06-17 · Updated 2021-09-17 · CVE-2020-3242

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco UCS Director (affected versions not specified)

Description The issue is related to a lack of protection for service data in Cisco UCS Director, which could allow a remote attacker to disclose sensitive information by sending a specially crafted request to the API. The vulnerability exists because confidential information is returned as part of an API response. An attacker with administrative privileges could exploit this to obtain the API key of another user, allowing them to impersonate that user's account on the affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2020-03120

CVE-2020-3242

Affected Products

Cisco Ucs Director

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsd-info-disclosure-gSMU8EKT · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03120 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3242 · Security Note