CVE-2019-16003 - Cisco UCS Director Information Disclosure Vulnerability

Back Back to CVE browser

MEDIUM

Cisco UCS Director Information Disclosure Vulnerability

Published Jan 26, 2020

5.3

MEDIUM

CVSS 3.1

EPSS 1.22%

Description

A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to download system log files from an affected device. The vulnerability is due to an issue in the authentication logic of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web interface. A successful exploit could allow the attacker to download log files if they were previously generated by an administrator.

Affected products

Vendor Cisco Product Cisco UCS Director Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cisco

Cisco UCS Director

n/a

Version	Status	Constraints
unspecified	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-6896
Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-ucs-dir-infodis
vendor-advisoryx_refsource_CISCOVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-6896		Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-ucs-dir-infodis		vendor-advisoryx_refsource_CISCOVendor Advisory