Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-6259

The JavaServer Pages (JSP) component in Cisco Integrated Management Controller (IMC) Supervisor before 1.0.0.1 and UCS Director (formerly Cloupia Unified Infrastructure Controller) before 5.2.0.1 allows remote attackers to write to arbitrary files via crafted HTTP requests, aka Bug IDs CSCus36435 and CSCus62625.

Published

2015-09-04T01:59:02.910

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 9.4 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

9.2

Weaknesses
  • Type: Primary
    CWE-20
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application cisco integrated_management_controller_supervisor ≤ 1.0.0.0 Yes
Application cisco unified_computing_system_director ≤ 5.2.0.0 Yes
Application cisco unified_computing_system_director 3.4_base Yes
Application cisco unified_computing_system_director 4.0_base Yes
Application cisco unified_computing_system_director 4.1_base Yes
Application cisco unified_computing_system_director 5.0.0.0 Yes
Application cisco unified_computing_system_director 5.0.0.1 Yes
Application cisco unified_computing_system_director 5.0.0.2 Yes
Application cisco unified_computing_system_director 5.0.0.3 Yes
Application cisco unified_computing_system_director 5.1.0.0 Yes
Application cisco unified_computing_system_director 5.1.0.1 Yes
References