Lucene search

CiscoCVE-2018-0319

HistoryJun 07, 2018 - 12:29 p.m.

CVE-2018-0319

2018-06-0712:29:00

CWE-287

CWE-255

cisco

web.nvd.nist.gov

cisco

prime collaboration provisioning

pcp

vulnerability

password recovery

unauthorized access

administrative privileges

cscvd07253

cve-2018-0319

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.005

Percentile

76.7%

JSON

A vulnerability in the password recovery function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to insufficient validation of a password recovery request. An attacker could exploit this vulnerability by submitting a password recovery request and changing the password for any user on an affected system. An exploit could allow the attacker to gain administrative-level privileges on the affected system. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 11.6 and prior. Cisco Bug IDs: CSCvd07253.

Affected configurations

Nvd

Node

ciscoprime_collaborationRange≤12.1

ciscoprime_collaboration_provisioningRange≤11.6

VendorProductVersionCPE
ciscoprime_collaboration*cpe:2.3:a:cisco:prime_collaboration:*:*:*:*:*:*:*:*
ciscoprime_collaboration_provisioning*cpe:2.3:a:cisco:prime_collaboration_provisioning:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	prime_collaboration	*	cpe:2.3:a:cisco:prime_collaboration::::::::
cisco	prime_collaboration_provisioning	*	cpe:2.3:a:cisco:prime_collaboration_provisioning::::::::

CNA Affected

[
  {
    "product": "Cisco Prime Collaboration Provisioning unknown",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Prime Collaboration Provisioning unknown"
      }
    ]
  }
]

References

www.securityfocus.com/bid/104431

www.securitytracker.com/id/1041079

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-password-recovery

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.005

Percentile

76.7%

JSON

Related for CVE-2018-0319