CVE-2020-26063

Cisco Integrated Management Controller Software Authorization Bypass Vulnerability

State: Published
Severity: 5.4 Medium
Published: Nov 18, 2024
Updated: Nov 18, 2024
Reserved: Sep 24, 2020

Description

A vulnerability in the API endpoints of Cisco Integrated Management Controller could allow an authenticated, remote attacker to bypass authorization and take actions on a vulnerable system without authorization. The vulnerability is due to improper authorization checks on API endpoints. An attacker could exploit this vulnerability by sending malicious requests to an API endpoint. An exploit could allow the attacker to download files from or modify limited configuration options on the affected system.There are no workarounds that address this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/RL:X/RC:X/E:X	cisco

Weaknesses

CWE-269 Improper Privilege Management

Affected Products

Product	Versions
Cisco Unified Computing System (Managed)Cisco	4.0(1a)Affected 3.2(3n)Affected 4.1(1a)Affected 4.1(1b)Affected 4.0(4h)Affected 4.1(1c)Affected 3.2(3k)Affected 3.2(2c)Affected 4.0(4e)Affected 4.0(4g)Affected 3.2(3i)Affected 4.0(2e)Affected 3.2(3g)Affected 4.0(4a)Affected 4.0(2d)Affected 3.2(2d)Affected 4.0(1b)Affected 4.0(4f)Affected 3.2(3h)Affected 3.2(2f)Affected 4.0(4c)Affected 3.2(3a)Affected 4.0(1c)Affected 3.2(3d)Affected 3.2(2b)Affected and 18 more versions

Product

Versions

Cisco Unified Computing System (Managed)Cisco

4.0(1a)Affected
3.2(3n)Affected
4.1(1a)Affected
4.1(1b)Affected
4.0(4h)Affected
4.1(1c)Affected
3.2(3k)Affected
3.2(2c)Affected
4.0(4e)Affected
4.0(4g)Affected
3.2(3i)Affected
4.0(2e)Affected
3.2(3g)Affected
4.0(4a)Affected
4.0(2d)Affected
3.2(2d)Affected
4.0(1b)Affected
4.0(4f)Affected
3.2(3h)Affected
3.2(2f)Affected
4.0(4c)Affected
3.2(3a)Affected
4.0(1c)Affected
3.2(3d)Affected
3.2(2b)Affected
and 18 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.