Details of VAR-201811-0186

ID

VAR-201811-0186

CVE

CVE-2018-15450

TITLE

Cisco Prime Collaboration Assurance Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-014051

DESCRIPTION

A vulnerability in the web-based UI of Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to overwrite files on the file system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using a specific UI input field to provide a custom path location. A successful exploit could allow the attacker to overwrite files on the file system. Cisco Prime Collaboration Assurance Contains an input validation vulnerability.Information may be tampered with. This issue is being tracked by Cisco Bug ID CSCvj07247. This solution supports simplified unified communication and video collaboration network management through a unified management console, and rapid deployment of communication sites

Trust: 1.98

sources: NVD: CVE-2018-15450 // JVNDB: JVNDB-2018-014051 // BID: 105864 // VULHUB: VHN-125711

AFFECTED PRODUCTS

vendor:	cisco	model:	prime collaboration	scope:	eq	version:	12.1	Trust: 1.0
vendor:	cisco	model:	prime collaboration	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	prime collaboration assurance	scope:	eq	version:	0	Trust: 0.3

sources: BID: 105864 // JVNDB: JVNDB-2018-014051 // NVD: CVE-2018-15450

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-15450
value:	MEDIUM
Trust: 1.0
ykramarz@cisco.com:	CVE-2018-15450
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2018-15450
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201811-187
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-125711
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-15450
severity:	MEDIUM
baseScore:	5.5
vectorString:	AV:N/AC:L/AU:S/C:N/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-125711
severity:	MEDIUM
baseScore:	5.5
vectorString:	AV:N/AC:L/AU:S/C:N/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

ykramarz@cisco.com:	CVE-2018-15450
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.0
Trust: 1.8
nvd@nist.gov:	CVE-2018-15450
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.1
Trust: 1.0

sources: VULHUB: VHN-125711 // JVNDB: JVNDB-2018-014051 // CNNVD: CNNVD-201811-187 // NVD: CVE-2018-15450 // NVD: CVE-2018-15450

PROBLEMTYPE DATA

problemtype:	CWE-20	Trust: 1.9
problemtype:	CWE-22	Trust: 1.1

sources: VULHUB: VHN-125711 // JVNDB: JVNDB-2018-014051 // NVD: CVE-2018-15450

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201811-187

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-201811-187

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-014051

PATCH

title:	cisco-sa-20181107-pca-overwrite	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-pca-overwrite	Trust: 0.8
title:	Cisco Prime Collaboration Assurance Enter the fix for the verification vulnerability	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=86658	Trust: 0.6

sources: JVNDB: JVNDB-2018-014051 // CNNVD: CNNVD-201811-187

EXTERNAL IDS

db:	NVD	id:	CVE-2018-15450	Trust: 2.8
db:	BID	id:	105864	Trust: 2.0
db:	JVNDB	id:	JVNDB-2018-014051	Trust: 0.8
db:	CNNVD	id:	CNNVD-201811-187	Trust: 0.7
db:	VULHUB	id:	VHN-125711	Trust: 0.1

sources: VULHUB: VHN-125711 // BID: 105864 // JVNDB: JVNDB-2018-014051 // CNNVD: CNNVD-201811-187 // NVD: CVE-2018-15450

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20181107-pca-overwrite	Trust: 2.0
url:	http://www.securityfocus.com/bid/105864	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-15450	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-15450	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: VULHUB: VHN-125711 // BID: 105864 // JVNDB: JVNDB-2018-014051 // CNNVD: CNNVD-201811-187 // NVD: CVE-2018-15450

CREDITS

This vulnerability was found during internal security testing.

Trust: 0.6

sources: CNNVD: CNNVD-201811-187

SOURCES

db:	VULHUB	id:	VHN-125711
db:	BID	id:	105864
db:	JVNDB	id:	JVNDB-2018-014051
db:	CNNVD	id:	CNNVD-201811-187
db:	NVD	id:	CVE-2018-15450

LAST UPDATE DATE

2024-11-23T23:08:33.553000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-125711	date:	2020-09-16T00:00:00
db:	BID	id:	105864	date:	2018-11-07T00:00:00
db:	JVNDB	id:	JVNDB-2018-014051	date:	2019-03-11T00:00:00
db:	CNNVD	id:	CNNVD-201811-187	date:	2020-09-17T00:00:00
db:	NVD	id:	CVE-2018-15450	date:	2024-11-21T03:50:49.800

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-125711	date:	2018-11-08T00:00:00
db:	BID	id:	105864	date:	2018-11-07T00:00:00
db:	JVNDB	id:	JVNDB-2018-014051	date:	2019-03-11T00:00:00
db:	CNNVD	id:	CNNVD-201811-187	date:	2018-11-08T00:00:00
db:	NVD	id:	CVE-2018-15450	date:	2018-11-08T20:29:00.230