Executive Summary
Summary | |
---|---|
Title | Cisco UCS Director Privilege Escalation Vulnerability |
Informations | |||
---|---|---|---|
Name | cisco-sa-20170215-ucs | First vendor Publication | 2017-02-15 |
Vendor | Cisco | Last vendor Modification | 2017-02-15 |
Severity (Vendor) | N/A | Revision | 1.0 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:L/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 4.6 | Attack Range | Local |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 3.9 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A vulnerability in the web-based GUI of Cisco UCS Director could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile. The vulnerability is due to improper role-based access control (RBAC) after the Developer Menu is enabled in Cisco UCS Director. Attackers could exploit this vulnerability by enabling Developer Mode for their user profile with an end-user profile and then adding new catalogs with arbitrary workflow items to the profile. An exploit could allow attackers to perform any actions defined by these workflow items, including actions affecting other tenants. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-ucs BEGIN PGP SIGNATURE iQIVAwUBWKRpgq89gD3EAJB5AQIH3g//UJsdf7eZW8Igzg1NAEAcGVZfnPxA3jlf wzps6+/z0fer3HbPtVFtH+Usl/RTQoH6Kg9e3ysZm9/UsYYMVMEBX6g9m8ICue0S dbAXmJC5hPtCmlHIO5J1te6KC2R+2uWt+6Uclkj+N/S0gj5V2KYKzsWvQF8rjUVl KemWygJshFzA5MuPWRNdXebBQwjHi6vhtK3rWjTQYafxSqpamjYa+k1AJ8UnlTnO yyVjURVlxh4P+KQizOMVg/Wi7ju/PVvyQN90eJ5/XHR2s8Fuq7xx0RsheMaLTTma 0hjOTkK70ckVVKe9o7XMBd+d2QONEueu503NUBbb1tCF1yjWCYBIn9AZvzY2CIRe /EhZxCoo0zmfbcOdKbkXnB3WnyHDX6Mln+QrS8+XgalDs/t/csk1fEieoT0VwZ23 BJWFrzmA56JfqKBJ4QrgpyNAeymkglUjpXl5w1m54AyCEgbr+sIGhoS6q70ZfkaK N9HRB4ORERjzVZ3YJsAHxp55Z8nYk3KIsN+ueUU5G+a01ACDoFzi0Mqg03Fs22mB syB0OvQwjvGBZjJE6bxC/D6/q2X/dCqdypdUMLwOVklyAs6GCzZTyO//dFQDMZXu Vpa1Lkp0617CBJXbH95ba07t7eEBQOXqNVNlj3JwO6qr48xSfw3rPkCsmv+0CggY FQlDeTuY29A= =W9Wa END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 2 |
Alert History
Date | Informations |
---|---|
2017-02-24 00:24:45 |
|
2017-02-15 17:21:22 |
|