CVE-2015-4279

The Manager component in Cisco Unified Computing System (UCS) 2.2(3b) on B Blade Server devices allows local users to gain privileges for executing arbitrary CLI commands by leveraging access to the subordinate fabric interconnect, aka Bug ID CSCut32778.

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://tools.cisco.com/security/center/viewAlert.x?alertId=39990	Vendor Advisory
http://www.securityfocus.com/bid/75953
http://www.securitytracker.com/id/1032999

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:unified_computing_system:2.2\(3b\):*:*:*:*:*:*:*

History

No history.

Information

Published : 2015-07-20 23:59

Updated : 2017-09-22 01:29

NVD link : CVE-2015-4279

Mitre link : CVE-2015-4279

CVE.ORG link : CVE-2015-4279

JSON object : View

Products Affected

cisco

unified_computing_system

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2015-4279", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-07-20T23:59:04.690", "references": [{"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=39990", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/75953", "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1032999", "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "The Manager component in Cisco Unified Computing System (UCS) 2.2(3b) on B Blade Server devices allows local users to gain privileges for executing arbitrary CLI commands by leveraging access to the subordinate fabric interconnect, aka Bug ID CSCut32778."}, {"lang": "es", "value": "Vulnerabilidad en el componente Manager en Cisco Unified Computing System (UCS) 2.2 (3b) sobre los dispositivos B Blade Server permite a usuarios locales obtener privilegios para ejecutar comandos arbitrarios en la CLI mediante el aprovechamiento de acceso subordinado del Fabric Interconect, tambi\u00e9n conocido como Bug ID CSCut32778."}], "lastModified": "2017-09-22T01:29:16.267", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:unified_computing_system:2.2\\(3b\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9068CA60-F05F-4C32-9828-5E13C981C39C"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}

7.2 /10