CVE-2019-1937

🗓️ 21 Aug 2019 18:25:13Reported by ciscoType

cve🔗 web.nvd.nist.gov👁 182 Views🌐 WEB

Cisco IMC Supervisor, UCS Director, and UCS Director Express for Big Data web interface allows unauthenticated attacker to acquire admin session token

Reporter	Title	Published	Views	Family All 22
0day.today	Cisco UCS Director, Cisco Integrated Management Controller Supervisor - Multiple Vulnerabilities	29 Aug 201900:00	–	zdt
0day.today	Cisco UCS Director Unauthenticated Remote Code Execution Exploit	2 Sep 201900:00	–	zdt
0day.today	Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass Vulnerability	15 Jul 202300:00	–	zdt
Circl	CVE-2019-1937	2 Sep 201915:56	–	circl
Cisco	Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability	21 Aug 201916:00	–	cisco
Tenable Nessus	Cisco UCS Director Authentication Bypass (cisco-sa-20190821-imcs-ucs-authby)	26 Aug 201900:00	–	nessus
Check Point Advisories	Cisco UCS Director Web Interface Authentication Bypass (CVE-2019-1937)	16 Sep 201900:00	–	checkpoint_advisories
Cvelist	CVE-2019-1937 Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability	21 Aug 201918:25	–	cvelist
Exploit DB	Cisco UCS Director, Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities	21 Aug 201900:00	–	exploitdb
Exploit DB	Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass	15 Jul 202300:00	–	exploitdb

NVD

Vulners

Node

cisco integrated_management_controller_supervisorRange2.2.0.3–2.2.0.6

Node

cisco ucs_directorRange6.6.0.0–6.6.1.0

cisco ucs_directorRange6.7.0.0–6.7.1.0

cisco ucs_directorMatch6.7(0.0.67265)

Node

cisco ucs_director_express_for_big_dataRange3.7.0.0–3.7.1.0

cisco ucs_director_express_for_big_dataMatch3.6.0.0

[
  {
    "vendor": "Cisco",
    "product": "Cisco Unified Computing System Director",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "6.7.3.0",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
seclists	www.seclists.org/fulldisclosure/2019/Aug/36
packetstormsecurity	www.packetstormsecurity.com/files/173531/Cisco-UCS-IMC-Supervisor-2.2.0.0-Authentication-Bypass.html
seclists	www.seclists.org/bugtraq/2019/Aug/49
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-ucs-authby
packetstormsecurity	www.packetstormsecurity.com/files/154308/Cisco-UCS-Director-Unauthenticated-Remote-Code-Execution.html
packetstormsecurity	www.packetstormsecurity.com/files/154239/Cisco-UCS-IMC-Supervisor-Authentication-Bypass-Command-Injection.html

Parameter	Position	Path	Description	CWE
apiName=GetUserInfo	path	/app/ui/ClientServlet?apiName=GetUserInfo	Authentication bypass via insufficient header validation enabling unauthorized access to a session token	CWE-287

21 Nov 2024 04:37Current

9.7High risk

Vulners AI Score9.7

CVSS 39.8

CVSS 210

EPSS0.90491

CWE-287