Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2020-26063

Cisco Integrated Management Controller Software Authorization Bypass Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisco

Description

A vulnerability in the API endpoints of Cisco Integrated Management Controller could allow an authenticated, remote attacker to bypass authorization and take actions on a vulnerable system without authorization. The vulnerability is due to improper authorization checks on API endpoints. An attacker could exploit this vulnerability by sending malicious requests to an API endpoint. An exploit could allow the attacker to download files from or modify limited configuration options on the affected system.There are no workarounds that address this vulnerability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cisco Cisco Unified Computing System (Managed)

Default version status: unknown

  • 4.0(1a)affected
  • 3.2(3n)affected
  • 4.1(1a)affected
  • 4.1(1b)affected
  • 4.0(4h)affected
  • 4.1(1c)affected
  • 3.2(3k)affected
  • 3.2(2c)affected
  • 4.0(4e)affected
  • 4.0(4g)affected
  • 3.2(3i)affected
  • 4.0(2e)affected
  • 3.2(3g)affected
  • 4.0(4a)affected
  • 4.0(2d)affected
  • 3.2(2d)affected
  • 4.0(1b)affected
  • 4.0(4f)affected
  • 3.2(3h)affected
  • 3.2(2f)affected
  • 4.0(4c)affected
  • 3.2(3a)affected
  • 4.0(1c)affected
  • 3.2(3d)affected
  • 3.2(2b)affected
  • 4.0(4b)affected
  • 3.2(2e)affected
  • 4.0(2b)affected
  • 4.0(4d)affected
  • 3.2(1d)affected
  • 3.2(3e)affected
  • 3.2(3l)affected
  • 3.2(3b)affected
  • 4.0(2a)affected
  • 3.2(3j)affected
  • 4.0(1d)affected
  • 3.2(3o)affected
  • 4.0(4i)affected
  • 4.1(1d)affected
  • 4.1(2a)affected
  • 4.1(1e)affected
  • 3.2(3p)affected
  • 4.1(2b)affected

References