CVE-2019-12634

CWE-264CWE-306 — Missing Authentication4 documents4 sources
Severity
7.5HIGH
EPSS
2.3%
top 15.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Cisco Cisco Unified Computing System DirectorCisco Integrated Management Controller SupervisorCisco UCS Director+1 more
Timeline
PublishedAug 21
Latest updateMay 24

Description

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to a missing authentication check in an API call. An attacker who can send a request to an affected system could cause all currently authenticated users to be logged off. Repeated exploitation could caus…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5cisco/cisco_unified_computing_system_directorunspecified — 6.7.3.0
▶NVDcisco/ucs_director_express3.7.0.0 — 3.7.2.0+2
▶NVDcisco/ucs_director6.7.0.0 — 6.7.2.0+2

🔴Vulnerability Details

2
GHSA
GHSA-rq9c-9fj9-7wh3: A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Di↗2022-05-24
▶
CVEList
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Denial of Service Vulnerability↗2019-08-21
▶

📋Vendor Advisories

1
Cisco
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Denial of Service Vulnerability↗2019-08-21
▶