CVE-2019-1863: cisco cisco unified computing system e-series software (ucse) Improper Authorization
Vulnerability summary
CVE-2019-1863 is a high (CVSS 9.0) Improper Authorization vulnerability in cisco cisco unified computing system e-series software (ucse). EPSS estimates a 1.70% chance of exploitation in the next 30 days, higher than 76.8% of scored vulnerabilities.
Timeline
- 21-08-2019PublishedVulnerability first disclosed.
- 21-11-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to make unauthorized changes to the system configuration. The vulnerability is due to insufficient authorization enforcement. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow a user with read-only privileges to change critical system configurations using administrator privileges.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
1.70%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
0.00 pp
From 1.70% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco3 products
- cisco unified computing system e-series software (ucse)≥ unspecified, < 2.0(13o)
- integrated_management_controller_supervisor≥ 1.5.0.0, < 1.5\(9g\) | ≥ 2.0.0.0, < 2.0\(13o\) | ≥ 3.0.0.0, < 3.0\(4k\) | ≥ 4.0.0.0, < 4.0\(4b\) | ≥ 4.0.0.0, < 4.0\(1d\) | ≥ 4.0.0.0, < 4.0\(2c\)
- unified_computing_system4.0\(1c\)hs3
1 vendor · 3 products
References
1 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imc-privilegeVendor AdvisoryX Refsource CISCO