Detections
Analytics

Cisco Unified Computing System (UCS) Central Software Improper Certificate Validation (cisco-sa-ucs-invcert-eOpRvCKH)

low Nessus Plugin ID 146450

Language:

Synopsis

The remote device is missing a vendor-supplied security patch

Description

According to its self-reported version, Cisco Unified Computing System Central Software is affected by an improper certificate validation vulnerability. An authenticated, adjacent attacker could exploit this, by sending a crafted HTTP request to the registration API, to register a rogue Cisco UCSM and gain access to Cisco UCS Central Software data and Cisco UCSM inventory data.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Solution

Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvw35850

See Also

http://www.nessus.org/u?bf1e3c29

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw35850

Plugin Details

Severity: Low

ID: 146450

File Name: cisco-sa-ucs-invcert-eOpRvCKH.nasl

Version: 1.3

Type: remote

Family: CISCO

Published: 2/12/2021

Updated: 3/8/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 1.4

CVSS v2

Risk Factor: Low

Base Score: 2.7

Temporal Score: 2

Vector: CVSS2#AV:A/AC:L/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2021-1354

CVSS v3

Risk Factor: Low

Base Score: 3.5

Temporal Score: 3.1

Vector: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:cisco:unified_computing_system_central

Required KB Items: installed_sw/Cisco UCS Central WebUI

Exploit Ease: No known exploits are available

Patch Publication Date: 2/3/2021

Vulnerability Publication Date: 2/3/2021

Reference Information

CVE: CVE-2021-1354

CWE: 295

CISCO-SA: cisco-sa-ucs-invcert-eOpRvCKH

IAVA: 2021-A-0075-S

CISCO-BUG-ID: CSCvw35850