PT-2018-8625 · Cisco · Cisco Spark

Published 2018-02-08 · Updated 2019-10-09 · CVE-2018-0119

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Cisco Spark (affected versions not specified)

Description: A vulnerability in Cisco Spark's account services authentication controls could allow an authenticated, remote attacker to access and view prohibited information on an affected device. This issue arises from the improper display of user-account tokens. An attacker could exploit this by logging in with a token used by another account, potentially causing a partial impact to the device's confidentiality, integrity, and availability.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2018-0119

Affected Products

Cisco Spark

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-spark · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0119 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0119 · Vendor Advisory
• http://securityfocus.com/bid/102961 · Note