CVE-2019-12634: cisco cisco unified computing system director

Vulnerability summary

CVE-2019-12634 is a high (CVSS 8.6) vulnerability in cisco cisco unified computing system director. EPSS estimates a 2.05% chance of exploitation in the next 30 days, higher than 80.8% of scored vulnerabilities.

Timeline

1. 21-08-2019
   PublishedVulnerability first disclosed.
2. 19-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to a missing authentication check in an API call. An attacker who can send a request to an affected system could cause all currently authenticated users to be logged off. Repeated exploitation could cause the inability to maintain a session in the web-based management portal.

• CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.