Unscored severity · published Sep 4, 2015
CVE-2015-6259
The JavaServer Pages (JSP) component in Cisco Integrated Management Controller (IMC) Supervisor before 1.0.0.1 and UCS Director (formerly Cloupia Unified Infrastructure…
–
CVSS
2.8%
EPSS
No
On KEV
Description
The JavaServer Pages (JSP) component in Cisco Integrated Management Controller (IMC) Supervisor before 1.0.0.1 and UCS Director (formerly Cloupia Unified Infrastructure Controller) before 5.2.0.1 allows remote attackers to write to arbitrary files via crafted HTTP requests, aka Bug IDs CSCus36435 and CSCus62625.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Integrated Management Controller Supervisor · Cisco
through 1.0.0.0 · source: NVD
UC
Unified Computing System Director · Cisco
through 5.2.0.0; 3.4_base; 4.0_base; 4.1_base; 5.0.0.0; 5.0.0.1; +4 more · source: NVD
Affected product
IM
Integrated Management Controller Supervisor
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-6259
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-6259
Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150902-cimcs
Third Party Advisory
http://www.securitytracker.com/id/1033451
More from Integrated Management Controller Supervisor
9.8
CVE-2019-1974
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data…
9.8
CVE-2019-1937
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data…
9.8
CVE-2019-1935
A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote…
8.8
CVE-2019-1907
A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to set sensitive configuration values and gain…
8.8
CVE-2019-1865
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary…