Cisco UCS Director API Response information disclosure

Summaryinfo

A vulnerability was found in Cisco UCS Director. It has been rated as problematic. The affected element is an unknown function of the component API. This manipulation as part of Response causes information disclosure. This vulnerability is tracked as CVE-2020-3242. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Cisco UCS Director (Virtualization Software) (version unknown). It has been declared as problematic. Affected by this vulnerability is an unknown function of the component API. The manipulation as part of a Response leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. The summary by CVE is:

A vulnerability in the REST API of Cisco UCS Director could allow an authenticated, remote attacker with administrative privileges to obtain confidential information from an affected device. The vulnerability exists because confidential information is returned as part of an API response. An attacker could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to obtain the API key of another user, which would allow the attacker to impersonate the account of that user on the affected device. To exploit this vulnerability, the attacker must have administrative privileges on the device.

The weakness was disclosed 06/18/2020 as cisco-sa-ucsd-info-disclosure- as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is known as CVE-2020-3242 since 12/12/2019. The attack can be launched remotely. The successful exploitation requires a single authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading eliminates this vulnerability.

The entry VDB-156876 is pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Virtualization Software

Vendor

• Cisco

Name

• UCS Director

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion