Cisco UCS Director and Cisco UCS Director Express for Big Data Multiple Vuulnerabilities (cisco-sa-ucsd-mult-vulns-UNfpdW4E)

critical Nessus Plugin ID 135766

Language:

Synopsis

The remote host is affected by multiple vulnerabilities.

Description

According to its self-reported version, the remote host is running a version of Cisco UCS Director that is affected by multiple vulnerabilities in the REST API which allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device, including the following:

- An unauthenticated, remote attacker can bypass authentication and execute arbitrary actions with administrative privileges on an affected device due to insufficient access control validation. An attacker can exploit this vulnerability by sending a crafted request to the REST API, allowing the attacker to interact with the REST API with administrative privileges. (CVE-2020-3243)

- An unauthenticated, remote attacker can execute arbitrary code with root privileges on the underlying operating system due to improper input validation. An attacker can exploit this by crafting a malicious file and sending it to the REST API. (CVE-2020-3240)

- An unauthenticated, remote attacker can bypass authentication and execute API calls on an affected device due to insufficient access control validation. An attacker can exploit this by sending a request to the REST API endpoint in order to cause a potential Denial of Service (DoS) condition on the affected device.
(CVE-2020-3250)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Apply the patch or upgrade to the version recommended in Cisco advisory.

Plugin Details

Severity: Critical

ID: 135766

File Name: cisco-sa-ucsd-mult-vulns-UNfpdW4E.nasl

Version: 1.6

Type: combined

Family: CISCO

Published: 4/21/2020

Updated: 3/15/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2020-3248

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

CVSS Score Source: CVE-2020-3250

Vulnerability Information

CPE: cpe:/a:cisco:ucs_director

Required KB Items: Host/Cisco/UCSDirector/version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/15/2020

Vulnerability Publication Date: 4/15/2020

Exploitable With

Metasploit (Cisco UCS Director Cloupia Script RCE)

Elliot (Cisco UCS Director Directory Traversal)

Reference Information

CVE: CVE-2020-3239, CVE-2020-3240, CVE-2020-3243, CVE-2020-3247, CVE-2020-3248, CVE-2020-3249, CVE-2020-3250, CVE-2020-3251, CVE-2020-3252

CISCO-BUG-ID: CSCvs53493, CSCvs53496, CSCvs53500, CSCvs53502, CSCvs56399, CSCvs56400, CSCvs56401, CSCvs69022, CSCvs69171, CSCvt39489, CSCvt39526, CSCvt39535, CSCvt39555, CSCvt39561, CSCvt39565, CSCvt39575, CSCvt39580

Detections

Analytics