CVE-2019-1974

Estado: ModificadaCrítica (9.8)—

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass user authentication and gain access as an administrative user. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to gain full administrative access to the affected device.

CVSS

Versión: 3.0
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 4.49%
Percentil entre todas las CVEs puntuadas: 91
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Cisco — Integrated Management Controller Supervisor Cisco — UCS Director Cisco — UCS Director Express FOR BIG Data

CWE

CWE-287
CWE-287

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2019-1974",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2019-1974",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-19T17:21:11.254332Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "psirt@cisco.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "Cisco",
          "product": "Cisco Unified Computing System Director",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "6.7.3.0",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-08-21T19:15:15.607",
  "references": [
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-ucs-authbypass",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-ucs-authbypass",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass user authentication and gain access as an administrative user. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to gain full administrative access to the affected device."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la interfaz de administración basada en la web del Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, y Cisco UCS Director Express for Big Data podría permitir que un atacante remoto no autenticado omita la autenticación del usuario y obtenga acceso como usuario administrativo. La vulnerabilidad se debe a una validación insuficiente del encabezado de la solicitud durante el proceso de autenticación. Un atacante podría aprovechar esta vulnerabilidad enviando una serie de solicitudes maliciosas a un dispositivo afectado. Un exploit podría permitir al atacante obtener acceso administrativo completo al dispositivo afectado."
    }
  ],
  "lastModified": "2026-06-17T02:29:43.780",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:integrated_management_controller_supervisor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B97B4B36-28E2-4550-B766-BA10DE00A33D",
              "versionEndIncluding": "2.2.0.6",
              "versionStartIncluding": "2.2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:integrated_management_controller_supervisor:2.1.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "512DAB16-F482-424A-AC39-69977B775AA4"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:ucs_director:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4261774A-C5C0-4FD7-A22F-0F692A0CA143",
              "versionEndIncluding": "5.5.0.2",
              "versionStartIncluding": "5.5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:ucs_director:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA47EBCE-BC99-457A-9A92-99E1BE0CEC6C",
              "versionEndIncluding": "6.0.1.3",
              "versionStartIncluding": "6.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:ucs_director:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F67EFEA-C5AE-48A9-AD08-946CD8528166",
              "versionEndIncluding": "6.5.0.3",
              "versionStartIncluding": "6.5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:ucs_director:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE74A216-65E1-433A-80EB-FBC8B5D242C9",
              "versionEndIncluding": "6.6.1.0",
              "versionStartIncluding": "6.6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:ucs_director:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E66FC72-9589-46A8-AC73-6A4A9BFE9FC1",
              "versionEndIncluding": "6.7.2.0",
              "versionStartIncluding": "6.7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:ucs_director:6.7\\(1.1\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E190903F-390D-49F8-BB31-9A06E5AE4A89"
            },
            {
              "criteria": "cpe:2.3:a:cisco:ucs_director:6.7\\(2.0\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05FC8BF4-72DE-4B3F-980C-2A5C3BBE02B3"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:ucs_director_express_for_big_data:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87D0F3ED-71E4-4E33-90A6-BC53CF3EFEAE",
              "versionEndIncluding": "2.1.0.2",
              "versionStartIncluding": "2.1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:ucs_director_express_for_big_data:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E730A2AE-2134-467E-8E9C-DEDAAEAE1606",
              "versionEndIncluding": "3.0.1.3",
              "versionStartIncluding": "3.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:ucs_director_express_for_big_data:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D88093E6-0362-437E-8FEA-486A69F05A9E",
              "versionEndIncluding": "3.5.0.3",
              "versionStartIncluding": "3.5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:ucs_director_express_for_big_data:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7317CA7D-B1A0-4F83-BA5F-6155459C8583",
              "versionEndIncluding": "3.7.2.0",
              "versionStartIncluding": "3.7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:cisco:ucs_director_express_for_big_data:3.6.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "451ABC79-936F-469E-B1D8-ADB3EDCA52F3"
            },
            {
              "criteria": "cpe:2.3:a:cisco:ucs_director_express_for_big_data:3.6.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C918805-0026-4780-A8E2-8BC85A8F7282"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}