4.3
CVE-2018-0266
- EPSS 0.16%
- Published 19.04.2018 20:29:01
- Last modified 21.11.2024 03:37:50
- Source psirt@cisco.com
- Teams watchlist Login
- Open Login
A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of database tables over the web interface. An attacker could exploit this vulnerability by browsing to a specific URL. An exploit could allow the attacker to view configuration parameters. Cisco Bug IDs: CSCvf20218.
Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Unified Communications Manager Version10.5(2.10000.5)
Cisco ≫ Unified Communications Manager Version11.0(1.10000.10)
Cisco ≫ Unified Communications Manager Version11.5(1.10000.6)
Cisco ≫ Unified Communications Manager Version12.0(1.10000.10)
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.16% | 0.371 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
| nvd@nist.gov | 4 | 8 | 2.9 |
AV:N/AC:L/Au:S/C:P/I:N/A:N
|
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-425 Direct Request ('Forced Browsing')
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.