Details of VAR-201901-0470

ID

VAR-201901-0470

CVE

CVE-2018-0474

TITLE

Cisco Unified Communications Manager Vulnerabilities in certificate and password management

Trust: 0.8

sources: JVNDB: JVNDB-2019-001367

DESCRIPTION

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view digest credentials in clear text. The vulnerability is due to the incorrect inclusion of saved passwords in configuration pages. An attacker could exploit this vulnerability by logging in to the Cisco Unified Communications Manager web-based management interface and viewing the source code for the configuration page. A successful exploit could allow the attacker to recover passwords and expose those accounts to further attack. This issue is being tracked by Cisco Bug ID CSCvc21606. This component provides a scalable, distributed and highly available enterprise IP telephony call processing solution

Trust: 1.98

sources: NVD: CVE-2018-0474 // JVNDB: JVNDB-2019-001367 // BID: 106538 // VULHUB: VHN-118676

AFFECTED PRODUCTS

vendor:	cisco	model:	unified communications manager	scope:	eq	version:	10.5\(2.14076.1\)	Trust: 1.0
vendor:	cisco	model:	unified communications manager	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	unified communications manager	scope:	eq	version:	0	Trust: 0.3

sources: BID: 106538 // JVNDB: JVNDB-2019-001367 // NVD: CVE-2018-0474

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-0474
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2018-0474
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2018-0474
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201901-303
value:	HIGH
Trust: 0.6
VULHUB:	VHN-118676
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-0474
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-118676
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-0474
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
ykramarz@cisco.com:	CVE-2018-0474
baseSeverity:	MEDIUM
baseScore:	4.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	1.4
version:	3.0
Trust: 1.0
NVD:	CVE-2018-0474
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-118676 // JVNDB: JVNDB-2019-001367 // CNNVD: CNNVD-201901-303 // NVD: CVE-2018-0474 // NVD: CVE-2018-0474

PROBLEMTYPE DATA

problemtype:	CWE-522	Trust: 1.1
problemtype:	CWE-200	Trust: 1.0
problemtype:	CWE-255	Trust: 0.9

sources: VULHUB: VHN-118676 // JVNDB: JVNDB-2019-001367 // NVD: CVE-2018-0474

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201901-303

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201901-303

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-001367

PATCH

title:	cisco-sa-20190109-cucm-creds-disclosr	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-cucm-creds-disclosr	Trust: 0.8
title:	Cisco Unified Communications Manager Repair measures for information disclosure vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=88504	Trust: 0.6

sources: JVNDB: JVNDB-2019-001367 // CNNVD: CNNVD-201901-303

EXTERNAL IDS

db:	NVD	id:	CVE-2018-0474	Trust: 2.8
db:	BID	id:	106538	Trust: 2.0
db:	JVNDB	id:	JVNDB-2019-001367	Trust: 0.8
db:	CNNVD	id:	CNNVD-201901-303	Trust: 0.7
db:	VULHUB	id:	VHN-118676	Trust: 0.1

sources: VULHUB: VHN-118676 // BID: 106538 // JVNDB: JVNDB-2019-001367 // CNNVD: CNNVD-201901-303 // NVD: CVE-2018-0474

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190109-cucm-creds-disclosr	Trust: 2.0
url:	http://www.securityfocus.com/bid/106538	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0474	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-0474	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3
url:	http://www.cisco.com/en/us/products/sw/voicesw/ps556/index.html	Trust: 0.3

sources: VULHUB: VHN-118676 // BID: 106538 // JVNDB: JVNDB-2019-001367 // CNNVD: CNNVD-201901-303 // NVD: CVE-2018-0474

CREDITS

This vulnerability was found during the resolution of a Cisco TAC support case.

Trust: 0.6

sources: CNNVD: CNNVD-201901-303

SOURCES

db:	VULHUB	id:	VHN-118676
db:	BID	id:	106538
db:	JVNDB	id:	JVNDB-2019-001367
db:	CNNVD	id:	CNNVD-201901-303
db:	NVD	id:	CVE-2018-0474

LAST UPDATE DATE

2024-08-14T14:56:59.720000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-118676	date:	2020-08-28T00:00:00
db:	BID	id:	106538	date:	2019-01-09T00:00:00
db:	JVNDB	id:	JVNDB-2019-001367	date:	2019-02-28T00:00:00
db:	CNNVD	id:	CNNVD-201901-303	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-0474	date:	2020-08-28T18:16:49.077

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-118676	date:	2019-01-10T00:00:00
db:	BID	id:	106538	date:	2019-01-09T00:00:00
db:	JVNDB	id:	JVNDB-2019-001367	date:	2019-02-28T00:00:00
db:	CNNVD	id:	CNNVD-201901-303	date:	2019-01-10T00:00:00
db:	NVD	id:	CVE-2018-0474	date:	2019-01-10T16:29:00.333