Lucene search

CiscoCVE-2018-0317

HistoryJun 07, 2018 - 12:29 p.m.

CVE-2018-0317

2018-06-0712:29:00

CWE-264

CWE-862

cisco

web.nvd.nist.gov

cisco

pcp

vulnerability

cve-2018-0317

web interface

access control

exploit

privilege escalation

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.002

Percentile

57.0%

JSON

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenticated, remote attacker to escalate their privileges. The vulnerability is due to insufficient web portal access control checks. An attacker could exploit this vulnerability by modifying an access request. An exploit could allow the attacker to promote their account to any role defined on the system. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 12.2 and prior. Cisco Bug IDs: CSCvc90286.

Affected configurations

Nvd

Node

ciscoprime_collaborationRange≤12.1

ciscoprime_collaboration_provisioningRange≤12.2

VendorProductVersionCPE
ciscoprime_collaboration*cpe:2.3:a:cisco:prime_collaboration:*:*:*:*:*:*:*:*
ciscoprime_collaboration_provisioning*cpe:2.3:a:cisco:prime_collaboration_provisioning:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	prime_collaboration	*	cpe:2.3:a:cisco:prime_collaboration::::::::
cisco	prime_collaboration_provisioning	*	cpe:2.3:a:cisco:prime_collaboration_provisioning::::::::

CNA Affected

[
  {
    "product": "Cisco Prime Collaboration Provisioning unknown",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Prime Collaboration Provisioning unknown"
      }
    ]
  }
]

References

www.securityfocus.com/bid/104432

www.securitytracker.com/id/1041080

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-bypass

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.002

Percentile

57.0%

JSON

Related for CVE-2018-0317