PT-2018-1839 · Cisco · Cisco Registered Envelope Service

Published 2018-11-07 · Updated 2020-09-16 · CVE-2018-15448

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Registered Envelope Service (CRES) (affected versions not specified)

Description: The issue is related to the user management functions of Cisco Registered Envelope Service, where an insecure configuration allows improper indexing, potentially revealing sensitive user information. An unauthenticated, remote attacker could exploit this by using a search engine to look for specific data strings, allowing them to discover certain sensitive information about the application, including usernames. This could enable the attacker to conduct additional reconnaissance attacks.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-16

CWE-612

Related Identifiers

BDU:2018-01441

CVE-2018-15448

Affected Products

Cisco Registered Envelope Service

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-res-info-disc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15448 · Security Note
• https://bdu.fstec.ru/vul/2018-01441 · Security Note
• http://securityfocus.com/bid/105862 · Note