PT-2018-8747 · Cisco · Cisco Prime Collaboration Provisioning

Publicado 2018-06-07 · Atualizado 2019-10-09 · CVE-2018-0317

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco Prime Collaboration Provisioning (PCP) versions prior to 12.2

Description: A vulnerability in the web interface could allow an authenticated, remote attacker to escalate their privileges due to insufficient web portal access control checks. An attacker could exploit this by modifying an access request, potentially promoting their account to any role defined on the system.

Recommendations: For versions prior to 12.2, update to a version later than 12.2 to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

CWE-264

Identificadores relacionados

CVE-2018-0317

Produtos afetados

Cisco Prime Collaboration Provisioning

Referências · 5

• http://securitytracker.com/id/1041080 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-0317 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-bypass · Aviso do Fabricante
• http://securityfocus.com/bid/104432 · Nota
• https://osv.dev/vulnerability/CVE-2018-0317 · Aviso do Fabricante