CVE-2020-3242— Cisco UCS Director Information Disclosure Vulnerability

Cisco UCS Director Information Disclosure Vulnerability

A vulnerability in the REST API of Cisco UCS Director could allow an authenticated, remote attacker with administrative privileges to obtain confidential information from an affected device. The vulnerability exists because confidential information is returned as part of an API response. An attacker could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to obtain the API key of another user, which would allow the attacker to impersonate the account of that user on the affected device. To exploit this vulnerability, the attacker must have administrative privileges on the device.

N/A

信息暴露

Cisco UCS Director 信息泄露漏洞

Cisco UCS Director是美国思科（Cisco）公司的一套私有云基础架构即服务（IaaS）的异构平台。 Cisco UCS Director 6.7.4.0之前版本中的REST API存在信息泄露漏洞，该漏洞源于API响应显示了机密信息。远程攻击者可借助特制请求利用该漏洞获取机密信息。

N/A

N/A