Privilege escalation in Cisco UCS Director - CVE-2017-3801
Published: February 15, 2017 / Updated: February 16, 2017
Vulnerability identifier: #VU5840
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-3801
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to obtain elevated privileges.
The vulnerability exists due to improper role-based access control (RBAC) in web-based management interface when the Developer Menu is enabled in Cisco UCS Director. A remote authenticated user can enable Developer Mode for his/her user profile with an end-user profile and then add new catalogs with arbitrary workflow items to his/her profile.
Successful exploitation of the vulnerability will allow an attacker to perform any actions defined by these workflow items, including actions affecting other tenants.
Affected software
Cisco UCS Director
How to mitigate CVE-2017-3801
Update to version 6.0.1.0.