CVE-2019-1627
Published on: 06/19/2019 12:00:00 AM UTC
Last Modified on: 03/23/2021 11:27:47 PM UTC
CVE-2019-1627 - advisory for cisco-sa-20190619-imc-infodiscl
Source: Mitre Source: NIST CVE.ORG Print: PDF
Certain versions of Integrated Management Controller from Cisco contain the following vulnerability:
A vulnerability in the Server Utilities of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to gain unauthorized access to sensitive user information from the configuration data that is stored on the affected system. The vulnerability is due to insufficient protection of data in the configuration file. An attacker could exploit this vulnerability by downloading the configuration file. An exploit could allow the attacker to use the sensitive information from the file to elevate privileges.
- CVE-2019-1627 has been assigned by
[email protected] to track the vulnerability - currently rated as MEDIUM severity. - The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
- Affected Vendor/Software: Cisco - Cisco Unified Computing System (Management Software) version 4.0(4b)
CVSS3 Score: 6.5 - MEDIUM
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | LOW | LOW | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | HIGH | NONE | NONE |
CVSS2 Score: 4 - MEDIUM
| Access Vector ⓘ |
Access Complexity |
Authentication |
|---|---|---|
| NETWORK | LOW | SINGLE |
| Confidentiality Impact |
Integrity Impact |
Availability Impact |
| PARTIAL | NONE | NONE |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| Cisco Integrated Management Controller Information Disclosure Vulnerability | Vendor Advisory tools.cisco.com text/html |
CISCO 20190619 Cisco Integrated Management Controller Information Disclosure Vulnerability |
| Malformed Request | Third Party Advisory VDB Entry cve.report (archive) text/html |
BID 108847 |
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Cisco | Integrated Management Controller | - | All | All | All |
| Application | Cisco | Integrated Management Controller | - | All | All | All |
| Application | Cisco | Unified Computing System | 4.0(1c)hs3 | All | All | All |
| Application | Cisco | Unified Computing System | 4.0\(1c\)hs3 | All | All | All |
| Application | Cisco | Unified Computing System | 4.0\(1c\)hs3 | All | All | All |
- cpe:2.3:a:cisco:integrated_management_controller:-:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:integrated_management_controller:-:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:unified_computing_system:4.0(1c)hs3:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:unified_computing_system:4.0\(1c\)hs3:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:unified_computing_system:4.0\(1c\)hs3:*:*:*:*:*:*:*: