A vulnerability has been found in Cisco UCS Director and UCS Director Express for Big Data (Virtualization Software) (the affected version unknown) and classified as critical. This vulnerability affects an unknown part of the component REST API. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

The weakness was shared 04/15/2020 as cisco-sa-ucsd-mult-vulns-UNfpd as confirmed advisory (Website). The advisory is available at tools.cisco.com. This vulnerability was named CVE-2020-3239 since 12/12/2019. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available.

Upgrading eliminates this vulnerability.

Productinfo

Type

• Virtualization Software

Vendor

• Cisco

Name

• UCS Director
• UCS Director Express for Big Data

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion