Resource exhaustion in Cisco Unified Computing System Director
CVE-2018-15404
A vulnerability in the web interface of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient restrictions on the size or total amount of resources allowed via the web interface. An attacker who has valid credentials for the application could exploit this vulnerability by sending a crafted or malformed HTTP request to the web interface. A successful exploit could allow the attacker to cause oversubscription of system resources or cause a component to become unresponsive, resulting in a DoS condition.
EPSS: 0.011 (62.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Cisco Unified Computing System Director — versions n/a
- Cisco Integrated_management_controller_supervisor — versions 2.1\(0.0\), 2.1(0.0)
- Cisco Unified_computing_system_director — versions 6.6(0.0), 6.6\(0.0\)
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-15404?
- CVE-2018-15404 is a medium-severity vulnerability in Cisco Unified Computing System Director, classified under CWE-399. CVSS score: 6.5/10. Published 2018-10-05.
- How severe is CVE-2018-15404?
- Medium severity. CVSS v3 base score is 6.5 out of 10.