Sign-up

ID

VAR-201810-0315


CVE

CVE-2018-0440


TITLE

Cisco Data Center Network Manager Vulnerabilities related to authorization, permissions, and access control

Trust: 0.8

sources: JVNDB: JVNDB-2018-013276

DESCRIPTION

A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticated application administrator to execute commands on the underlying operating system with root-level privileges. The vulnerability is due to incomplete input validation of user input within an HTTP request. An attacker could exploit this vulnerability by authenticating to the application and then sending a crafted HTTP request to the targeted application. A successful exploit could allow the authenticated attacker to issue commands on the underlying operating system as the root user. Cisco Data Center Network Manager is a set of data center management system of Cisco (Cisco). The system is available for Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting functions

Trust: 1.71

sources: NVD: CVE-2018-0440 // JVNDB: JVNDB-2018-013276 // VULHUB: VHN-118642

AFFECTED PRODUCTS

vendor:ciscomodel:data center network managerscope:ltversion:11.0\(1\)

Trust: 1.0

vendor:ciscomodel:data center network managerscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2018-013276 // NVD: CVE-2018-0440

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-0440
value: HIGH

Trust: 1.0

NVD: CVE-2018-0440
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201809-268
value: HIGH

Trust: 0.6

VULHUB: VHN-118642
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-0440
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-118642
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-0440
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-118642 // JVNDB: JVNDB-2018-013276 // CNNVD: CNNVD-201809-268 // NVD: CVE-2018-0440

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.8

problemtype:CWE-20

Trust: 1.1

sources: VULHUB: VHN-118642 // JVNDB: JVNDB-2018-013276 // NVD: CVE-2018-0440

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201809-268

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201809-268

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-013276

PATCH
title:cisco-sa-20180905-cdcnm-escalationurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-cdcnm-escalation
Trust: 0.8
title:Cisco Data Center Network Manager Fixes for permission permissions and access control vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=84599
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2018-013276 // 
            
            
            
            CNNVD: CNNVD-201809-268

EXTERNAL IDS
db:NVDid:CVE-2018-0440
Trust: 2.5
db:SECTRACKid:1041682
Trust: 1.7
db:JVNDBid:JVNDB-2018-013276
Trust: 0.8
db:CNNVDid:CNNVD-201809-268
Trust: 0.7
db:VULHUBid:VHN-118642
Trust: 0.1
sources:
            
            
            VULHUB: VHN-118642 // 
            
            
            
            JVNDB: JVNDB-2018-013276 // 
            
            
            
            CNNVD: CNNVD-201809-268 // 
            
            
            
            NVD: CVE-2018-0440

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20180905-cdcnm-escalation
Trust: 1.7
url:http://www.securitytracker.com/id/1041682
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0440
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-0440
Trust: 0.8
sources:
            
            
            VULHUB: VHN-118642 // 
            
            
            
            JVNDB: JVNDB-2018-013276 // 
            
            
            
            CNNVD: CNNVD-201809-268 // 
            
            
            
            NVD: CVE-2018-0440

SOURCES
db:VULHUBid:VHN-118642
db:JVNDBid:JVNDB-2018-013276
db:CNNVDid:CNNVD-201809-268
db:NVDid:CVE-2018-0440

LAST UPDATE DATE
2024-08-14T15:28:47.827000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-118642date:2019-10-09T00:00:00
db:JVNDBid:JVNDB-2018-013276date:2019-02-18T00:00:00
db:CNNVDid:CNNVD-201809-268date:2019-10-17T00:00:00
db:NVDid:CVE-2018-0440date:2019-10-09T23:32:05.273

SOURCES RELEASE DATE
db:VULHUBid:VHN-118642date:2018-10-05T00:00:00
db:JVNDBid:JVNDB-2018-013276date:2019-02-18T00:00:00
db:CNNVDid:CNNVD-201809-268date:2018-09-06T00:00:00
db:NVDid:CVE-2018-0440date:2018-10-05T14:29:02.357