Improper access control in Cisco Systems, Inc products - CVE-2020-3329
Published: May 7, 2020
Vulnerability identifier: #VU27582
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2020-3329
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Cisco Systems, Inc
Affected software:
Cisco Integrated Management Controller Supervisor
Cisco UCS Director
Cisco UCS Director Express for Big Data
Cisco Integrated Management Controller Supervisor
Cisco UCS Director
Cisco UCS Director Express for Big Data
Detailed vulnerability description
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to incorrect allocation of the enable/disable action button under the role-based access control code. A remote user with read-only permission can update the roles of other users to disable them, including administrative users.
How to mitigate CVE-2020-3329
Install updates from vendor's website.