PT-2018-8714 · Cisco · Cisco Dna Center

Published 2018-05-17 · Updated 2019-10-09 · CVE-2018-0271

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco DNA Center Software Releases prior to 1.1.2

Description: A vulnerability in the API gateway of the Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and access critical services. The issue is due to a failure to normalize URLs prior to servicing requests. An attacker could exploit this by submitting a crafted URL, potentially gaining unauthenticated access to critical services and resulting in elevated privileges in DNA Center.

Recommendations: For Cisco DNA Center Software Releases prior to 1.1.2, update to a version 1.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the API gateway to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-0271

Affected Products

Cisco Dna Center

References · 4

• https://osv.dev/vulnerability/CVE-2018-0271 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0271 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-dna2 · Vendor Advisory
• http://securityfocus.com/bid/104191 · Note