Improper access control in Cisco Systems, Inc products - CVE-2020-3329

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU27582

Improper access control in Cisco Systems, Inc products - CVE-2020-3329

Published: May 7, 2020


Vulnerability identifier: #VU27582
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-3329
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to incorrect allocation of the enable/disable action button under the role-based access control code. A remote user with read-only permission can update the roles of other users to disable them, including administrative users.


Affected software

Cisco Integrated Management Controller Supervisor
Cisco UCS Director
Cisco UCS Director Express for Big Data

How to mitigate CVE-2020-3329

Install updates from vendor's website.

Cisco Integrated Management Controller Supervisor - update to 2.2.1.3
Cisco UCS Director - update to 6.7.4.0
Cisco UCS Director Express for Big Data - update to 3.7.4.0

External References

Related Security Bulletins