Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveCiscoCVE-2020-3329
HistoryMay 06, 2020 - 5:15 p.m.

CVE-2020-3329

2020-05-0617:15:13
CWE-284
cisco
web.nvd.nist.gov
33
cisco
vulnerability
access control
role-based
authentication
remote attacker
user account disablement

CVSS2

4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

31.7%

JSON

A vulnerability in role-based access control of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow a read-only authenticated, remote attacker to disable user accounts on an affected system. The vulnerability is due to incorrect allocation of the enable/disable action button under the role-based access control code on an affected system. An attacker could exploit this vulnerability by authenticating as a read-only user and then updating the roles of other users to disable them. A successful exploit could allow the attacker to disable users, including administrative users.

Affected configurations

Nvd
Node
ciscointegrated_management_controller_supervisorRange1.1.0.0–2.2.1.3
OR
ciscoucs_directorRange5.4.0.0–6.7.4.0
OR
ciscoucs_director_express_for_big_dataRange2.0.0.0–3.7.4.0
VendorProductVersionCPE
ciscointegrated_management_controller_supervisor*cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*
ciscoucs_director*cpe:2.3:a:cisco:ucs_director:*:*:*:*:*:*:*:*
ciscoucs_director_express_for_big_data*cpe:2.3:a:cisco:ucs_director_express_for_big_data:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "product": "Cisco UCS Director",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

Related

cisco 1
cvelist 1
prion 1
nvd 1
nessus 1
cisco
cisco
Cisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Role-Based Access Control Vulnerability
2020-05-06 16:00:00
cvelist
cvelist
CVE-2020-3329 Cisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Role-Based Access Control Vulnerability
2020-05-06 16:40:52
prion
prion
Design/Logic Flaw
2020-05-06 17:15:00
nvd
nvd
CVE-2020-3329
2020-05-06 17:15:13
nessus
nessus
Cisco UCS Director for Role-Based Access Control (cisco-sa-ucsd-Ar6BAguz)
2020-06-04 00:00:00

CVSS2

4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

31.7%

JSON
Related for CVE-2020-3329
cisco1cvelist1prion1nvd1nessus1