CVE-2020-3329
mediumPriorität · verfolgen · 17EPSS 0.007 · 52. PerzentilEUUSEPSS · bewertet 2026-10-27
A vulnerability in role-based access control of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow a read-only authenticated, remote attacker to disable user accounts on an affected system. The vulnerability is due to incorrect allocation of the enable/disable action button under the role-based access control code on an affected system. An attacker could exploit this vulnerability by authenticating as a read-only user and then updating the roles of other users to disable them. A successful exploit could allow the attacker to disable users, including administrative users.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Kein Fix verfügbar; Exposition mindern.
- Kein Fix verfügbarCisco Integrated Management Controller (IMC) Supervisorcisco_csaf
No remediation is available at this time.
- Kein Fix verfügbarCisco UCS Directorcisco_csaf
No remediation is available at this time.
- Kein Fix verfügbarCisco Unified Computing System Director Express for Big Data cisco_csaf
No remediation is available at this time.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (7)
Betroffene Produkte und Versionsbereiche.
- cisco integrated management controller supervisor1.1.0.0 → 2.2.1.3nvdUScpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*
- cisco ucs director express for big data2.0.0.0 → 3.7.4.0nvdUScpe:2.3:a:cisco:ucs_director_express_for_big_data:*:*:*:*:*:*:*:*
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- cisco-sa-ucsd-Ar6BAguzCisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Role-Based Access Control Vulnerability2020-05-06csaf · cisco_csafUS
A vulnerability in role-based access control of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow a read-only authenticated, remote attacker to disable user accounts on an affected system. The vulnerability is due to incorrect allocation of the enable/disable action button under the role-based access control code on an affected system. An attacker could exploit this vulnerability by authenticating as a read-only user and then updating the roles of other users to disable them. A successful exploit could allow the attacker to disable users, including administrative users. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (6)
Externe Belege — Patches, Meldungen, Analysen.
- https://nvd.nist.gov/vuln/detail/CVE-2020-3329cnnvd
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsd-Ar6BAguzcnnvd
- https://vigilance.fr/vulnerability/Cisco-Unified-Computing-System-Director-privilege-escalation-32207cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.1618/cnnvd
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsd-Ar6BAguzenisa_euvd
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsd-Ar6BAguzVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan