A vulnerability, which was classified as problematic, has been found in Cisco Integrated Management Controller (version now known). Affected by this issue is some unknown processing of the component Web-based Management Interface. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is integrity. CVE summarizes:

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected device. An attacker could exploit this vulnerability by persuading a user to follow a malicious link. A successful exploit could allow the attacker to use a web browser and the privileges of the user to perform arbitrary actions on the affected device.

The weakness was published 06/20/2019 as cisco-sa-20190619-imc-csrf as confirmed advisory (Website). The advisory is available at tools.cisco.com. This vulnerability is handled as CVE-2019-1632 since 12/06/2018. The attack may be launched remotely. Required for exploitation is a simple authentication. The technical details are unknown and an exploit is not available.

Upgrading eliminates this vulnerability.

Similar entries are available at 136729, 136728, 136727 and 136726.

Productinfo

Vendor

• Cisco

Name

• Integrated Management Controller

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion