CVE-2019-1627 Cisco Integrated Management Controller Information Disclosure Vulnerability

Medium 6.5 Published 20 Jun 2019 Updated 21 Nov 2024

Authenticated attackers can download configuration files to expose sensitive data and elevate privileges in Cisco Integrated Management Controller.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-1627?

CVE-2019-1627 is a medium-severity vulnerability in Cisco Unified Computing System, published on 20 Jun 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the Server Utilities of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to gain unauthorized access to sensitive user information from the configuration data that is stored on the affected system. The vulnerability is due to insufficient protection of data in the configuration file. An attacker could exploit this vulnerability by downloading the configuration file. An exploit could allow the attacker to use the sensitive information from the file to elevate privileges.

Weakness: CWE-312, CWE-78

Which versions are affected by CVE-2019-1627?

It affects 2 products.

Products include Cisco Integrated Management Controller, Cisco Unified Computing System.

How do I fix CVE-2019-1627?

No fix has been published for CVE-2019-1627 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-1627 being exploited?

There is no known exploitation of CVE-2019-1627 in the wild and no public exploit code.

All Cisco Unified Computing System vulnerabilities

Sources

Also known as GHSA-j3hq-7fm4-h8h6.