Vulnerabilities > CVE-2020-3329 - Unspecified vulnerability in Cisco products

CVSS 4.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

SINGLE

Confidentiality impact

NONE

Integrity impact

PARTIAL

Availability impact

NONE

network

low complexity

cisco

nessus

NVD

Published: 2020-05-06

Updated: 2021-10-26

Summary

A vulnerability in role-based access control of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow a read-only authenticated, remote attacker to disable user accounts on an affected system. The vulnerability is due to incorrect allocation of the enable/disable action button under the role-based access control code on an affected system. An attacker could exploit this vulnerability by authenticating as a read-only user and then updating the roles of other users to disable them. A successful exploit could allow the attacker to disable users, including administrative users.

Vulnerable Configurations

Part	Description	Count
Application	Cisco Cisco Integrated Management Controller Supervisor 1.1.0.0 Cisco Integrated Management Controller Supervisor 1.5\(1B\) Cisco Integrated Management Controller Supervisor 1.5\(1F\) Cisco Integrated Management Controller Supervisor 1.5\(1J\) Cisco Integrated Management Controller Supervisor 1.5\(1K\) Cisco Integrated Management Controller Supervisor 1.5\(1L\) Cisco Integrated Management Controller Supervisor 1.5\(2\) Cisco Integrated Management Controller Supervisor 1.5\(2\)3 Cisco Integrated Management Controller Supervisor 1.5\(3D\) Cisco Integrated Management Controller Supervisor 1.5\(3G\) Cisco Integrated Management Controller Supervisor 1.5\(3H\)1 Cisco Integrated Management Controller Supervisor 1.5\(4\)3 Cisco Integrated Management Controller Supervisor 1.5\(4G\) Cisco Integrated Management Controller Supervisor 1.5\(5\) Cisco Integrated Management Controller Supervisor 1.5\(7A\)2 Cisco Integrated Management Controller Supervisor 1.5\(7C\)2 Cisco Integrated Management Controller Supervisor 1.5\(7E\) Cisco Integrated Management Controller Supervisor 1.5\(7F\) Cisco Integrated Management Controller Supervisor 1.5\(9G\) Cisco Integrated Management Controller Supervisor 1.5.0.0 Cisco Integrated Management Controller Supervisor 2.0\(13O\) Cisco Integrated Management Controller Supervisor 2.0.0.0 Cisco Integrated Management Controller Supervisor 2.1\(0.0\) Cisco Integrated Management Controller Supervisor 2.1\(0.2\) Cisco Integrated Management Controller Supervisor 2.1.0.0 Cisco Integrated Management Controller Supervisor 2.1.0.1 Cisco Integrated Management Controller Supervisor 2.1.0.2 Cisco Integrated Management Controller Supervisor 2.2\(0.2\) Cisco Integrated Management Controller Supervisor 2.2.0.0 Cisco Integrated Management Controller Supervisor 2.2.0.1 Cisco Integrated Management Controller Supervisor 2.2.0.2 Cisco Integrated Management Controller Supervisor 2.2.0.3 Cisco Integrated Management Controller Supervisor 2.2.0.4 Cisco Integrated Management Controller Supervisor 2.2.0.5 Cisco Integrated Management Controller Supervisor 2.2.0.6 Cisco Integrated Management Controller Supervisor 2.2.1.0 Cisco UCS Director 5.4.0.0 Cisco UCS Director 5.4.0.1 Cisco UCS Director 5.4.0.2 Cisco UCS Director 5.4.0.3 Cisco UCS Director 5.4.0.4 Cisco UCS Director 5.5.0.0 Cisco UCS Director 5.5.0.1 Cisco UCS Director 5.5.0.2 Cisco UCS Director 6.0 Cisco UCS Director 6.0\(1.0\) Cisco UCS Director 6.0\(1.1\) Cisco UCS Director 6.0\(1.2\) Cisco UCS Director 6.0\(1.3\) Cisco UCS Director 6.0.0.0 Cisco UCS Director 6.0.0.1 Cisco UCS Director 6.0.1.0 Cisco UCS Director 6.0.1.1 Cisco UCS Director 6.0.1.2 Cisco UCS Director 6.0.1.3 Cisco UCS Director 6.5\(0.0.65832\) Cisco UCS Director 6.5.0.0 Cisco UCS Director 6.5.0.1 Cisco UCS Director 6.5.0.2 Cisco UCS Director 6.5.0.3 Cisco UCS Director 6.5.0.4 Cisco UCS Director 6.6 Cisco UCS Director 6.6\(1.0\) Cisco UCS Director 6.6.0.0 Cisco UCS Director 6.6.1.0 Cisco UCS Director 6.6.2.0 Cisco UCS Director 6.7 Cisco UCS Director 6.7\(0.0.67265\) Cisco UCS Director 6.7\(1.0\) Cisco UCS Director 6.7\(1.1\) Cisco UCS Director 6.7\(2.0\) Cisco UCS Director 6.7\(2.2.67425\) Cisco UCS Director 6.7\(3.0\) Cisco UCS Director 6.7.0.0 Cisco UCS Director 6.7.1.0 Cisco UCS Director 6.7.2.0 Cisco UCS Director 6.7.3.0 Cisco UCS Director 6.7.3.1 Cisco UCS Director Express FOR BIG Data 2.0.0.0 Cisco UCS Director Express FOR BIG Data 2.1.0.0 Cisco UCS Director Express FOR BIG Data 2.1.0.2 Cisco UCS Director Express FOR BIG Data 3.0.0.0 Cisco UCS Director Express FOR BIG Data 3.0.1.3 Cisco UCS Director Express FOR BIG Data 3.5.0.0 Cisco UCS Director Express FOR BIG Data 3.5.0.3 Cisco UCS Director Express FOR BIG Data 3.6.0.0 Cisco UCS Director Express FOR BIG Data 3.6.1.0 Cisco UCS Director Express FOR BIG Data 3.7.0.0 Cisco UCS Director Express FOR BIG Data 3.7.1.0 Cisco UCS Director Express FOR BIG Data 3.7.2.0 Cisco UCS Director Express FOR BIG Data 3.7.3.0	91

Nessus

NASL family	CISCO
NASL id	CISCO-SA-UCSD-AR6BAGUZ.NASL
description	According to its self-reported version, the remote host is running a version of Cisco UCS Director that is affected by role-Based Access Control vulnerability. A remote authenticated attacker could exploit this vulnerability by updating the roles of other users to disable them. A successful exploit could allow the attacker to disable users, including administrative users. Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-10
modified	2020-06-04
plugin id	137134
published	2020-06-04
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/137134
title	Cisco UCS Director for Role-Based Access Control (cisco-sa-ucsd-Ar6BAguz)

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsd-Ar6BAguz