PT-2018-1771 · Cisco · Cisco Prime Collaboration Assurance

Published 2018-11-07 · Updated 2020-09-16 · CVE-2018-15450

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime Collaboration Assurance (affected versions not specified)

Description The issue is caused by insufficient input validation in the web-based UI, allowing a remote attacker to overwrite files on the file system. An attacker could exploit this by using a specific UI input field to provide a custom path location. This could allow the attacker to overwrite files on the file system.

Recommendations For Cisco Prime Collaboration Assurance, ensure proper input validation is in place to prevent file overwriting. As a temporary workaround, consider restricting access to the web-based UI to minimize the risk of exploitation. Avoid using specific UI input fields that could allow custom path locations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Weakness Enumeration

CWE-20

CWE-22

Related Identifiers

BDU:2018-01371

CVE-2018-15450

Affected Products

Cisco Prime Collaboration Assurance

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-pca-overwrite · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-15450 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15450 · Security Note
• https://bdu.fstec.ru/vul/2018-01371 · Security Note
• http://securityfocus.com/bid/105864 · Note