SB2017021605 - Privilege escalation in Cisco UCS Director

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017021605

SB2017021605 - Privilege escalation in Cisco UCS Director

Published: February 16, 2017

Security Bulletin ID SB2017021605
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Privilege escalation (CVE-ID: CVE-2017-3801)

The vulnerability allows a remote authenticated user to obtain elevated privileges.

The vulnerability exists due to improper role-based access control (RBAC) in web-based management interface when the Developer Menu is enabled in Cisco UCS Director. A remote authenticated user can enable Developer Mode for his/her user profile with an end-user profile and then add new catalogs with arbitrary workflow items to his/her profile.

Successful exploitation of the vulnerability will allow an attacker to perform any actions defined by these workflow items, including actions affecting other tenants.


Remediation

Install update from vendor's website.

References