{"id":"CVE-2019-1908","state":"PUBLISHED","title":"Cisco Integrated Management Controller Information Disclosure Vulnerability","description":"A vulnerability in the Intelligent Platform Management Interface (IPMI) implementation of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to view sensitive system information. The vulnerability is due to insufficient security restrictions imposed by the affected software. A successful exploit could allow the attacker to view sensitive information that belongs to other users. The attacker could then use this information to conduct additional attacks.","publishedAt":"2019-08-21T18:25:28.253Z","updatedAt":"2024-11-19T19:00:21.605Z","severity":{"score":7.5,"label":"High","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"cisco"},"assigner":"cisco","products":["Cisco Cisco Unified Computing System (Management Software)"],"affected":[{"vendor":"Cisco","product":"Cisco Unified Computing System (Management Software)","versions":[{"version":"unspecified","status":"affected","lessThan":"3.0(4k)","versionType":"custom"}]}],"references":["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imc-infodisc"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T19:45:46.792Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/1xxx/CVE-2019-1908.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2019-1908","state":"PUBLISHED","datePublished":"2019-08-21T18:25:28.253Z","dateUpdated":"2024-11-19T19:00:21.605Z","assignerShortName":"cisco","assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateReserved":"2018-12-06T00:00:00.000Z"},"containers":{"cna":{"title":"Cisco Integrated Management Controller Information Disclosure Vulnerability","descriptions":[{"lang":"en","value":"A vulnerability in the Intelligent Platform Management Interface (IPMI) implementation of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to view sensitive system information. The vulnerability is due to insufficient security restrictions imposed by the affected software. A successful exploit could allow the attacker to view sensitive information that belongs to other users. The attacker could then use this information to conduct additional attacks."}],"affected":[{"vendor":"Cisco","product":"Cisco Unified Computing System (Management Software)","versions":[{"version":"unspecified","status":"affected","lessThan":"3.0(4k)","versionType":"custom"}]}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imc-infodisc","name":"20190821 Cisco Integrated Management Controller Information Disclosure Vulnerability","tags":["vendor-advisory","x_refsource_CISCO"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"cisco","dateUpdated":"2019-08-21T18:25:28.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633"},"datePublic":"2019-08-21T00:00:00.000Z","exploits":[{"lang":"en","value":"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}],"source":{"advisory":"cisco-sa-20190821-imc-infodisc","defect":[["CSCvo36096"]],"discovery":"INTERNAL"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","DATE_PUBLIC":"2019-08-21T16:00:00-0700","ID":"CVE-2019-1908","STATE":"PUBLIC","TITLE":"Cisco Integrated Management Controller Information Disclosure Vulnerability"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Cisco Unified Computing System (Management Software)","version":{"version_data":[{"affected":"<","version_affected":"<","version_value":"3.0(4k)"}]}}]},"vendor_name":"Cisco"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A vulnerability in the Intelligent Platform Management Interface (IPMI) implementation of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to view sensitive system information. The vulnerability is due to insufficient security restrictions imposed by the affected software. A successful exploit could allow the attacker to view sensitive information that belongs to other users. The attacker could then use this information to conduct additional attacks."}]},"exploit":[{"lang":"en","value":"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}],"impact":{"cvss":{"baseScore":"7.5","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-200"}]}]},"references":{"reference_data":[{"name":"20190821 Cisco Integrated Management Controller Information Disclosure Vulnerability","refsource":"CISCO","url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imc-infodisc"}]},"source":{"advisory":"cisco-sa-20190821-imc-infodisc","defect":[["CSCvo36096"]],"discovery":"INTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imc-infodisc","name":"20190821 Cisco Integrated Management Controller Information Disclosure Vulnerability","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T18:35:52.083Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-11-19T17:23:23.161578Z","id":"CVE-2019-1908","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-19T19:00:21.605Z"}}]}}}