CVE-2019-1863 — Improper Authorization in Cisco Unified Computing System E-series Software

CWE-285 — Improper Authorization5 documents5 sources
Severity
8.1HIGHNVD
EPSS
0.1%
top 78.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco Unified Computing System E-series SoftwareCisco Integrated Management Controller SupervisorCisco Unified Computing System
Timeline
PublishedAug 21
Latest updateMay 24

Description

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to make unauthorized changes to the system configuration. The vulnerability is due to insufficient authorization enforcement. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow a user with read-only privileges to change critical system configurations using…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HExploitability: 2.8 | Impact: 5.2

Affected Packages3 packages

▶CVEListV5cisco/cisco_unified_computing_system_e-series_softwareunspecified — 2.0(13o)

🔴Vulnerability Details

2
GHSA
GHSA-m6xp-ghfg-8fj4: A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote at↗2022-05-24
▶
CVEList
Cisco Integrated Management Controller Privilege Escalation Vulnerability↗2019-08-21
▶

📋Vendor Advisories

1
Cisco
Cisco Integrated Management Controller Privilege Escalation Vulnerability↗2019-08-21
▶
CVE-2019-1863 — Improper Authorization in Cisco | cvebase