A vulnerability was found in Cisco Integrated Management Controller, UCS Director and UCS Director Express for Big Data (Virtualization Software) (affected version not known). It has been rated as problematic. Affected by this issue is some unknown functionality of the component Web-based Management Console. The manipulation as part of a API Call leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is availability. CVE summarizes:

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to a missing authentication check in an API call. An attacker who can send a request to an affected system could cause all currently authenticated users to be logged off. Repeated exploitation could cause the inability to maintain a session in the web-based management portal.

The weakness was shared 08/21/2019 as cisco-sa-20190821-ucs-imc-dos as confirmed advisory (Website). The advisory is available at tools.cisco.com. This vulnerability is handled as CVE-2019-12634 since 06/04/2019. The attack may be launched remotely. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

Upgrading eliminates this vulnerability.

The entries VDB-101746, VDB-119224, VDB-124829 and VDB-124830 are related to this item.

Productinfo

Type

• Virtualization Software

Vendor

• Cisco

Name

• Integrated Management Controller
• UCS Director
• UCS Director Express for Big Data

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion