cisco-sa-ucsd-Ar6BAguz: Cisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Role-Based Access Control Vulnerability
First published: Wed May 06 2020(Updated: )
A vulnerability in role-based access control of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow a read-only authenticated, remote attacker to disable user accounts on an affected system. The vulnerability is due to incorrect allocation of the enable/disable action button under the role-based access control code on an affected system. An attacker could exploit this vulnerability by authenticating as a read-only user and then updating the roles of other users to disable them. A successful exploit could allow the attacker to disable users, including administrative users. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsd-Ar6BAguz
Credit: Andrzej Chrominski Atende Sreporting this vulnerability.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Integrated Management Controller Supervisor | ||
| Cisco UCS Director | ||
| Cisco UCS Director Express for Big Data |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-ucsd-Ar6BAguz?
The cisco-sa-ucsd-Ar6BAguz vulnerability is classified as a critical security issue affecting access control.
How do I fix cisco-sa-ucsd-Ar6BAguz?
To mitigate the cisco-sa-ucsd-Ar6BAguz vulnerability, it is essential to apply the latest patches provided by Cisco for the affected software.
Who is affected by cisco-sa-ucsd-Ar6BAguz?
The cisco-sa-ucsd-Ar6BAguz vulnerability affects users of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data.
What type of attack does cisco-sa-ucsd-Ar6BAguz enable?
The cisco-sa-ucsd-Ar6BAguz vulnerability enables a read-only authenticated remote attacker to disable user accounts on the affected systems.
When was cisco-sa-ucsd-Ar6BAguz disclosed?
The cisco-sa-ucsd-Ar6BAguz vulnerability was disclosed by Cisco on the date specified in their security advisory.
- agent/author
- agent/type
- agent/event
- agent/last-modified-date
- collector/cisco-advisory
- source/Cisco
- agent/references
- agent/severity
- agent/title
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco integrated management controller supervisor
- canonical/cisco ucs director
- canonical/cisco ucs director express for big data