Lucene search

CiscoCVE-2018-15404

HistoryOct 05, 2018 - 2:29 p.m.

CVE-2018-15404

2018-10-0514:29:08

CWE-770

CWE-399

cisco

web.nvd.nist.gov

cve

2018

15404

cisco

imc supervisor

ucs director

web interface

dos

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

44.2%

JSON

A vulnerability in the web interface of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient restrictions on the size or total amount of resources allowed via the web interface. An attacker who has valid credentials for the application could exploit this vulnerability by sending a crafted or malformed HTTP request to the web interface. A successful exploit could allow the attacker to cause oversubscription of system resources or cause a component to become unresponsive, resulting in a DoS condition.

Affected configurations

Nvd

Node

ciscounified_computing_system_directorMatch6.6\(0.0\)

Node

ciscointegrated_management_controller_supervisorMatch2.1\(0.0\)

VendorProductVersionCPE
ciscounified_computing_system_director6.6(0.0)cpe:2.3:a:cisco:unified_computing_system_director:6.6\(0.0\):*:*:*:*:*:*:*
ciscointegrated_management_controller_supervisor2.1(0.0)cpe:2.3:a:cisco:integrated_management_controller_supervisor:2.1\(0.0\):*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	unified_computing_system_director	6.6(0.0)	cpe:2.3:a:cisco:unified_computing_system_director:6.6\(0.0\):::::::*
cisco	integrated_management_controller_supervisor	2.1(0.0)	cpe:2.3:a:cisco:integrated_management_controller_supervisor:2.1\(0.0\):::::::*

CNA Affected

[
  {
    "product": "Cisco Unified Computing System Director",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-imcs-ucsd-dos

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

44.2%

JSON

Related for CVE-2018-15404