CVE-2020-3250 - Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data

Back Back to CVE browser

CRITICAL

Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data

Published Apr 15, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 60.95%

Description

Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products

Vendor Cisco Product Cisco UCS Director Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cisco

Cisco UCS Director

n/a

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-269

Improper Privilege Management

References (3)

http://packetstormsecurity.com/files/157955/Cisco-UCS-Director-Cloupia-Script-Remote-Code-Execution.html
x_refsource_MISC
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsd-mult-vulns-UNfpdW4E
vendor-advisoryx_refsource_CISCOVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-538/
x_refsource_MISCThird Party AdvisoryVDB Entry

Link	Providers	Tags
http://packetstormsecurity.com/files/157955/Cisco-UCS-Director-Cloupia-Script-Remote-Code-Execution.html		x_refsource_MISC
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsd-mult-vulns-UNfpdW4E		vendor-advisoryx_refsource_CISCOVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-538/		x_refsource_MISCThird Party AdvisoryVDB Entry