Details of VAR-201906-0565

ID

VAR-201906-0565

CVE

CVE-2019-1627

TITLE

Cisco Integrated Management Controller Vulnerable to information disclosure

Trust: 0.8

sources: JVNDB: JVNDB-2019-005668

DESCRIPTION

A vulnerability in the Server Utilities of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to gain unauthorized access to sensitive user information from the configuration data that is stored on the affected system. The vulnerability is due to insufficient protection of data in the configuration file. An attacker could exploit this vulnerability by downloading the configuration file. An exploit could allow the attacker to use the sensitive information from the file to elevate privileges. Cisco Integrated Management Controller (IMC) Contains an information disclosure vulnerability.Information may be obtained. This issue is being tracked by Cisco bug ID CSCvo01184. The software supports HTTP, SSH access, etc., and can perform operations such as starting, shutting down and restarting the server

Trust: 2.07

sources: NVD: CVE-2019-1627 // JVNDB: JVNDB-2019-005668 // BID: 108847 // VULHUB: VHN-148399 // VULMON: CVE-2019-1627

AFFECTED PRODUCTS

vendor:	cisco	model:	unified computing system	scope:	eq	version:	4.0\(1c\)hs3	Trust: 1.0
vendor:	cisco	model:	integrated management controller	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	integrated management controller	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	unified computing system central software	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ucs c-series servers	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	integrated management controller	scope:	eq	version:	0	Trust: 0.3

sources: BID: 108847 // JVNDB: JVNDB-2019-005668 // NVD: CVE-2019-1627

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-1627
value:	MEDIUM
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-1627
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-1627
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201906-785
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-148399
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2019-1627
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-1627
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-148399
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

ykramarz@cisco.com:	CVE-2019-1627
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.0
Trust: 1.8
nvd@nist.gov:	CVE-2019-1627
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.1
Trust: 1.0

sources: VULHUB: VHN-148399 // VULMON: CVE-2019-1627 // JVNDB: JVNDB-2019-005668 // CNNVD: CNNVD-201906-785 // NVD: CVE-2019-1627 // NVD: CVE-2019-1627

PROBLEMTYPE DATA

problemtype:	CWE-312	Trust: 1.1
problemtype:	CWE-78	Trust: 1.0
problemtype:	CWE-200	Trust: 0.9

sources: VULHUB: VHN-148399 // JVNDB: JVNDB-2019-005668 // NVD: CVE-2019-1627

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201906-785

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201906-785

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-005668

PATCH

title:	cisco-sa-20190619-imc-infodiscl	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-imc-infodiscl	Trust: 0.8
title:	Cisco Integrated Management Controller Fixes for operating system command injection vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=93935	Trust: 0.6
title:	Cisco: Cisco Integrated Management Controller Information Disclosure Vulnerability	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20190619-imc-infodiscl	Trust: 0.1

sources: VULMON: CVE-2019-1627 // JVNDB: JVNDB-2019-005668 // CNNVD: CNNVD-201906-785

EXTERNAL IDS

db:	NVD	id:	CVE-2019-1627	Trust: 2.9
db:	BID	id:	108847	Trust: 2.1
db:	JVNDB	id:	JVNDB-2019-005668	Trust: 0.8
db:	CNNVD	id:	CNNVD-201906-785	Trust: 0.7
db:	AUSCERT	id:	ESB-2019.2188	Trust: 0.6
db:	VULHUB	id:	VHN-148399	Trust: 0.1
db:	VULMON	id:	CVE-2019-1627	Trust: 0.1

sources: VULHUB: VHN-148399 // VULMON: CVE-2019-1627 // BID: 108847 // JVNDB: JVNDB-2019-005668 // CNNVD: CNNVD-201906-785 // NVD: CVE-2019-1627

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190619-imc-infodiscl	Trust: 2.2
url:	http://www.securityfocus.com/bid/108847	Trust: 1.9
url:	https://nvd.nist.gov/vuln/detail/cve-2019-1627	Trust: 1.4
url:	http://www.cisco.com/	Trust: 0.9
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1627	Trust: 0.8
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190619-imc-infodisclos	Trust: 0.6
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190619-imc-dos	Trust: 0.6
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190619-imc-frmwr-dos	Trust: 0.6
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190619-imc-csrf	Trust: 0.6
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190619-cimc-cli-cmdinj	Trust: 0.6
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190619-imc-filewrite	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2019.2188/	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/312.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-148399 // VULMON: CVE-2019-1627 // BID: 108847 // JVNDB: JVNDB-2019-005668 // CNNVD: CNNVD-201906-785 // NVD: CVE-2019-1627

CREDITS

Cisco.

Trust: 0.9

sources: BID: 108847 // CNNVD: CNNVD-201906-785

SOURCES

db:	VULHUB	id:	VHN-148399
db:	VULMON	id:	CVE-2019-1627
db:	BID	id:	108847
db:	JVNDB	id:	JVNDB-2019-005668
db:	CNNVD	id:	CNNVD-201906-785
db:	NVD	id:	CVE-2019-1627

LAST UPDATE DATE

2024-11-23T22:11:59.630000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-148399	date:	2020-10-06T00:00:00
db:	VULMON	id:	CVE-2019-1627	date:	2020-10-06T00:00:00
db:	BID	id:	108847	date:	2019-06-19T00:00:00
db:	JVNDB	id:	JVNDB-2019-005668	date:	2019-06-25T00:00:00
db:	CNNVD	id:	CNNVD-201906-785	date:	2020-10-09T00:00:00
db:	NVD	id:	CVE-2019-1627	date:	2024-11-21T04:36:57.790

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-148399	date:	2019-06-20T00:00:00
db:	VULMON	id:	CVE-2019-1627	date:	2019-06-20T00:00:00
db:	BID	id:	108847	date:	2019-06-19T00:00:00
db:	JVNDB	id:	JVNDB-2019-005668	date:	2019-06-25T00:00:00
db:	CNNVD	id:	CNNVD-201906-785	date:	2019-06-20T00:00:00
db:	NVD	id:	CVE-2019-1627	date:	2019-06-20T03:15:11.480