PT-2018-8714 · Cisco · Cisco Dna Center

Publicado 2018-05-17 · Atualizado 2019-10-09 · CVE-2018-0271

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco DNA Center Software Releases prior to 1.1.2

Description: A vulnerability in the API gateway of the Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and access critical services. The issue is due to a failure to normalize URLs prior to servicing requests. An attacker could exploit this by submitting a crafted URL, potentially gaining unauthenticated access to critical services and resulting in elevated privileges in DNA Center.

Recommendations: For Cisco DNA Center Software Releases prior to 1.1.2, update to a version 1.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the API gateway to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2018-0271

Produtos afetados

Cisco Dna Center

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-0271 · Aviso do Fabricante
• http://securityfocus.com/bid/104191 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-0271 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-dna2 · Aviso do Fabricante