CVE-2019-1938: Cisco UCS Director and Cisco UCS Director Express for Big Data API Authentication Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The vulnerability is due to improper authentication request handling. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an unprivileged attacker to access and execute arbitrary actions through certain APIs.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-1938?
CVE-2019-1938 is a vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data that allows an unauthenticated remote attacker to bypass authentication and execute arbitrary actions with administrator privileges.
How severe is CVE-2019-1938?
CVE-2019-1938 has a severity rating of critical with a score of 9.8 out of 10.
Which systems are affected by CVE-2019-1938?
Cisco UCS Director versions 6.7.0.0 and 6.7.1.0, as well as Cisco UCS Director Express for Big Data versions 3.7.0.0 and 3.7.1.0, are affected by CVE-2019-1938.
How can I fix CVE-2019-1938?
To fix CVE-2019-1938, it is recommended to apply the necessary patches and updates provided by Cisco.
Where can I find more information about CVE-2019-1938?
More information about CVE-2019-1938 can be found on the official Cisco Security Advisory page: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-ucsd-authbypass