CWE Code: 863
Vulnerability Type: privilege_escalation
CVSS Score: 4.6
CWE Name:  Incorrect Authorization
Summary: a vulnerability in the web-based gui of cisco ucs director 6.0.0.0 and 6.0.0.1 could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile, a privilege escalation vulnerability. the vulnerability is due to improper role-based access control (rbac) after the developer menu is enabled in cisco ucs director. an attacker could exploit this vulnerability by enabling developer mode for his/her user profile with an end-user profile and then adding new catalogs with arbitrary workflow items to his/her profile. an exploit could allow an attacker to perform any actions defined by these workflow items, including actions affecting other tenants. cisco bug ids: cscvb64765.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2017-02-15
Last Modified Date: 2019-10-03