CVE-2019-1908
Last modified
CVE-2019-1908 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A vulnerability in the Intelligent Platform Management Interface (IPMI) implementation of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to view sensitive system information. The vulnerability is due to insufficient security restrictions imposed by the affected software. EPSS estimates a 2.00% chance of exploitation in the next 30 days.
Description
A vulnerability in the Intelligent Platform Management Interface (IPMI) implementation of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to view sensitive system information. The vulnerability is due to insufficient security restrictions imposed by the affected software. A successful exploit could allow the attacker to view sensitive information that belongs to other users. The attacker could then use this information to conduct additional attacks.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Unified Computing System | 4.0\(1c\)hs3 |
| Cisco | Integrated Management Controller Supervisor | >= 2.0.0.0, < 2.0\(13o\) |
| Cisco | Integrated Management Controller Supervisor | >= 3.0.0.0, < 3.0\(4k\) |
| Cisco | Integrated Management Controller Supervisor | >= 4.0.0.0, < 4.0\(4b\) |
| Cisco | Integrated Management Controller Supervisor | >= 4.0.0.0, < 4.0\(2f\) |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-1908?
How severe is CVE-2019-1908?
How do I fix CVE-2019-1908?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-19074A memory leak in the ath9k_wmi_cmd() function in drivers/net…7.5
- CVE-2019-19075A memory leak in the ca8210_probe() function in drivers/net/…7.5
- CVE-2019-19076A memory leak in the nfp_abm_u32_knode_replace() function in…5.9
- CVE-2019-19077A memory leak in the bnxt_re_create_srq() function in driver…5.5
- CVE-2019-19078A memory leak in the ath10k_usb_hif_tx_sg() function in driv…7.5
- CVE-2019-19079A memory leak in the qrtr_tun_write_iter() function in net/q…7.5
- CVE-2019-19080Four memory leaks in the nfp_flower_spawn_phy_reprs() functi…5.9
- CVE-2019-19081A memory leak in the nfp_flower_spawn_vnic_reprs() function …5.9
- CVE-2019-19082Memory leaks in *create_resource_pool() functions under driv…4.7
- CVE-2019-19083Memory leaks in *clock_source_create() functions under drive…4.7
- CVE-2019-19084In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated …4.3
- CVE-2019-19085A persistent cross-site scripting (XSS) vulnerability in Oct…5.4
Are you affected by CVE-2019-1908?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST