Path traversal in Cisco UCS Director Express for Big Data and Cisco UCS Director - CVE-2020-3239

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU26983

Path traversal in Cisco UCS Director Express for Big Data and Cisco UCS Director - CVE-2020-3239

Published: April 16, 2020


Vulnerability identifier: #VU26983
CSH Severity: High
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-3239
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the REST API . A remote authenticated attacker can send a specially crafted zip file and write or execute arbitrary files on the system with full administrative privileges.


Affected software

Cisco UCS Director Express for Big Data
Cisco UCS Director

How to mitigate CVE-2020-3239

Install update from vendor's website.

Cisco UCS Director Express for Big Data - update to 3.7.4.0
Cisco UCS Director - update to 6.7.4.0

External References

Related Security Bulletins