CVE-2019-16003 Cisco UCS Director Information Disclosure Vulnerability
Unauthenticated attackers can bypass authentication to download system log files from Cisco UCS Director via the web interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-16003?
CVE-2019-16003 is a medium-severity authentication bypass vulnerability in Cisco UCS Director, published on 26 Jan 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to download system log files from an affected device. The vulnerability is due to an issue in the authentication logic of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web interface. A successful exploit could allow the attacker to download log files if they were previously generated by an administrator.
Weakness: CWE-306
Which versions are affected by CVE-2019-16003?
It affects 1 product.
Products include Cisco Ucs Director.
How do I fix CVE-2019-16003?
No fix has been published for CVE-2019-16003 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-16003 being exploited?
There is no known exploitation of CVE-2019-16003 in the wild and no public exploit code.
Other vulnerabilities in Cisco UCS Director
- CVE-2020-3239 Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
- CVE-2020-3240 Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
- CVE-2020-3243 Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
- CVE-2020-3247 Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
- CVE-2020-3248 Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
Sources
Also known as GHSA-5h32-5fxq-gm74.