CVE-2018-15404: Cisco Integrated Management Controller Supervisor and Cisco UCS Director System Resources Denial of Service Vulnerability
First published: Fri Oct 05 2018(Updated: )
A vulnerability in the web interface of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient restrictions on the size or total amount of resources allowed via the web interface. An attacker who has valid credentials for the application could exploit this vulnerability by sending a crafted or malformed HTTP request to the web interface. A successful exploit could allow the attacker to cause oversubscription of system resources or cause a component to become unresponsive, resulting in a DoS condition.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Computing System Director | =6.6\(0.0\) | |
| Cisco Integrated Management Controller Supervisor | =2.1\(0.0\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2018-15404.
What is the severity rating of CVE-2018-15404?
CVE-2018-15404 has a severity rating of 6.5 (medium).
What software is affected by CVE-2018-15404?
CVE-2018-15404 affects Cisco Unified Computing System Director 6.6(0.0) and Cisco Integrated Management Controller Supervisor 2.1(0.0).
How can an attacker exploit CVE-2018-15404?
An attacker can exploit CVE-2018-15404 by causing a denial of service (DoS) condition on an affected system.
Is there a fix available for CVE-2018-15404?
Yes, Cisco has released a fix for CVE-2018-15404. Please refer to the Cisco Security Advisory for more information.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/title
- agent/references
- agent/tags
- agent/event
- agent/description
- agent/first-publish-date
- vendor/cisco
- canonical/cisco unified computing system director
- version/cisco unified computing system director/6.6\(0.0\)
- canonical/cisco integrated management controller supervisor
- version/cisco integrated management controller supervisor/2.1\(0.0\)