NULL pointer dereference in Cisco Unified Computing System (Management Software)
CVE-2019-1900
A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to cause the web server process to crash, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient validation of user-supplied input on the web interface. An attacker could exploit this vulnerability by submitting a crafted HTTP request to certain endpoints of the affected software. A successful exploit could allow an attacker to cause the web server to crash. Physical access to the device may be required for a restart.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.019 (79.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 79th percentile — 79.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.019 · newest: 0.019 · change: 0.000
Affected products
- Cisco Unified Computing System (Management Software) — versions unspecified
- Cisco Integrated Management Controller Supervisor
- Cisco Ucs C125 M5
- Cisco Ucs C4200
- Cisco Ucs S3260
- Cisco Unified Computing System — versions 4.0\(1c\)hs3, 4.0(1c)hs3
Weakness classification (CWE)
References
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821… (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-1900?
- CVE-2019-1900 is a high-severity vulnerability in Cisco Unified Computing System (Management Software), classified under NULL Pointer Dereference. CVSS score: 7.5/10. Published 2019-08-21.
- How severe is CVE-2019-1900?
- High severity. CVSS v3 base score is 7.5 out of 10.