CVE-2018-15405 — Improper Authorization in Cisco Unified Computing System Director

CWE-285 — Improper AuthorizationCWE-863 — Incorrect Authorization4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 69.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Unified Computing System DirectorCisco UCS Director
Timeline
PublishedOct 5
Latest updateMay 13

Description

A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to an authorization check that does not properly include the access level of the web interface user. An attacker who has valid application credentials could exploit this vulnerability by sending a crafted HTTP request to the web interface. A successfu…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDcisco/ucs_director2.1\(0.0\), 6.6\(1.0\)+1

🔴Vulnerability Details

2
GHSA
GHSA-rwrr-92p6-jxrh: A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could↗2022-05-13
▶
CVEList
Cisco Integrated Management Controller Supervisor and Cisco UCS Director Authenticated Web Interface Information Disclosure Vulnerability↗2018-10-05
▶

📋Vendor Advisories

1
Cisco
Cisco Integrated Management Controller Supervisor and Cisco UCS Director Authenticated Web Interface Information Disclosure Vulnerability↗2018-10-03
▶