Lucene search

CiscoCVE-2018-0318

HistoryJun 07, 2018 - 12:29 p.m.

CVE-2018-0318

2018-06-0712:29:00

CWE-287

CWE-255

cisco

web.nvd.nist.gov

cve-2018-0318

vulnerability

password reset

cisco prime collaboration provisioning

pcp

unauthorized access

administrative-level privileges

nvd

cscvd07245

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.005

Percentile

76.7%

JSON

A vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to insufficient validation of a password reset request. An attacker could exploit this vulnerability by submitting a password reset request and changing the password for any user on an affected system. An exploit could allow the attacker to gain administrative-level privileges on the affected system. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 11.6 and prior. Cisco Bug IDs: CSCvd07245.

Affected configurations

Nvd

Node

ciscoprime_collaborationRange≤12.1

ciscoprime_collaboration_provisioningRange≤11.6

VendorProductVersionCPE
ciscoprime_collaboration*cpe:2.3:a:cisco:prime_collaboration:*:*:*:*:*:*:*:*
ciscoprime_collaboration_provisioning*cpe:2.3:a:cisco:prime_collaboration_provisioning:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	prime_collaboration	*	cpe:2.3:a:cisco:prime_collaboration::::::::
cisco	prime_collaboration_provisioning	*	cpe:2.3:a:cisco:prime_collaboration_provisioning::::::::

CNA Affected

[
  {
    "product": "Cisco Prime Collaboration Provisioning unknown",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Prime Collaboration Provisioning unknown"
      }
    ]
  }
]

References

www.securityfocus.com/bid/104434

www.securitytracker.com/id/1041082

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-password-reset

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.005

Percentile

76.7%

JSON

Related for CVE-2018-0318