CVE-2019-1938: Cisco UCS Director and Cisco UCS Director Express for Big Data API Authentication Bypass Vulnerability
First published: Wed Aug 21 2019(Updated: )
A vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The vulnerability is due to improper authentication request handling. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an unprivileged attacker to access and execute arbitrary actions through certain APIs.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco UCS Director | =6.7.0.0 | |
| Cisco UCS Director | =6.7.1.0 | |
| Cisco UCS Director Express for Big Data | =3.7.0.0 | |
| Cisco UCS Director Express for Big Data | =3.7.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-1938?
CVE-2019-1938 is a vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data that allows an unauthenticated remote attacker to bypass authentication and execute arbitrary actions with administrator privileges.
How severe is CVE-2019-1938?
CVE-2019-1938 has a severity rating of critical with a score of 9.8 out of 10.
Which systems are affected by CVE-2019-1938?
Cisco UCS Director versions 6.7.0.0 and 6.7.1.0, as well as Cisco UCS Director Express for Big Data versions 3.7.0.0 and 3.7.1.0, are affected by CVE-2019-1938.
How can I fix CVE-2019-1938?
To fix CVE-2019-1938, it is recommended to apply the necessary patches and updates provided by Cisco.
Where can I find more information about CVE-2019-1938?
More information about CVE-2019-1938 can be found on the official Cisco Security Advisory page: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-ucsd-authbypass
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/author
- agent/first-publish-date
- agent/tags
- agent/description
- agent/event
- vendor/cisco
- canonical/cisco ucs director
- version/cisco ucs director/6.7.0.0
- version/cisco ucs director/6.7.1.0
- canonical/cisco ucs director express for big data
- version/cisco ucs director express for big data/3.7.0.0
- version/cisco ucs director express for big data/3.7.1.0