CVE-2018-0113

EPSS 1.11%
Published 08.02.2018 07:29:00
Last modified 21.11.2024 03:37:32
Source psirt@cisco.com
Teams watchlist Login
Open Login

A vulnerability in an operations script of Cisco UCS Central could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the daemon user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by posting a crafted request to the user interface of Cisco UCS Central. This vulnerability affects Cisco UCS Central Software prior to Release 2.0(1c). Cisco Bug IDs: CSCve70825.

Affected products Warnungen 0 Metrics 3 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Cisco ≫ Unified Computing System Central Software Version1.5(1c)

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	1.11%	0.772

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	6.5	8	6.4	AV:N/AC:L/Au:S/C:P/I:P/A:P

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.securityfocus.com/bid/102966

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1040337

Third Party Advisory

VDB Entry

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-ucsc

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2018-0113

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-0113

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-0113

EUVD