PT-2018-1839 · Cisco · Cisco Registered Envelope Service

Publicado 2018-11-07 · Atualizado 2020-09-16 · CVE-2018-15448

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Registered Envelope Service (CRES) (affected versions not specified)

Description: The issue is related to the user management functions of Cisco Registered Envelope Service, where an insecure configuration allows improper indexing, potentially revealing sensitive user information. An unauthenticated, remote attacker could exploit this by using a search engine to look for specific data strings, allowing them to discover certain sensitive information about the application, including usernames. This could enable the attacker to conduct additional reconnaissance attacks.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-16

CWE-612

Identificadores relacionados

BDU:2018-01441

CVE-2018-15448

Produtos afetados

Cisco Registered Envelope Service

Referências · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-res-info-disc · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-15448 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-01441 · Nota de Segurança
• http://securityfocus.com/bid/105862 · Nota