Summaryinfo

A vulnerability has been found in Cisco Integrated Management Controller and classified as critical. Impacted is an unknown function of the component Web Server. This manipulation as part of HTTP Request causes improper authorization. This vulnerability appears as CVE-2019-1907. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Detailsinfo

A vulnerability classified as critical was found in Cisco Integrated Management Controller (the affected version unknown). Affected by this vulnerability is an unknown part of the component Web Server. The manipulation as part of a HTTP Request leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to set sensitive configuration values and gain elevated privileges. The vulnerability is due to improper handling of substring comparison operations that are performed by the affected software. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow the attacker with read-only privileges to gain administrator privileges.

The weakness was presented 08/21/2019 as cisco-sa-20190821-imc-privesca as confirmed advisory (Website). It is possible to read the advisory at tools.cisco.com. This vulnerability is known as CVE-2019-1907 since 12/06/2018. The attack can be launched remotely. A single authentication is necessary for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

See VDB-140564, VDB-140562, VDB-140561 and VDB-140560 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Cisco

Name

• Integrated Management Controller

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion