PT-2018-2097 · Cisco · Cisco Prime Infrastructure

Pedro Ribeiro · Published 2018-10-03 · Updated 2019-10-09 · CVE-2018-15379

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure (affected versions not specified)

Description A vulnerability exists due to incorrect permission settings for important system directories in the HTTP web server for Cisco Prime Infrastructure. This could allow an unauthenticated, remote attacker to upload an arbitrary file, potentially enabling the execution of commands at the privilege level of the user 'prime', which does not have administrative or root privileges. The vulnerability can be exploited by uploading a malicious file using TFTP, accessible via the web-interface GUI. A successful exploit could allow the attacker to run commands on the targeted application without authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-732

CWE-275

Related Identifiers

BDU:2019-00048

CVE-2018-15379

Affected Products

Cisco Prime Infrastructure

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cisco_prime_inf_rce.rb · Exploit
• 🔥 https://exploit-db.com/exploits/45555 · Exploit
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-pi-tftp · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00048 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15379 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15379 · Security Note
• http://securitytracker.com/id/1041816 · Note
• http://securityfocus.com/bid/105506 · Note
• https://securityfocus.com/bid/105506/info · Note