PT-2018-8747 · Cisco · Cisco Prime Collaboration Provisioning

Published 2018-06-07 · Updated 2019-10-09 · CVE-2018-0317

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco Prime Collaboration Provisioning (PCP) versions prior to 12.2

Description: A vulnerability in the web interface could allow an authenticated, remote attacker to escalate their privileges due to insufficient web portal access control checks. An attacker could exploit this by modifying an access request, potentially promoting their account to any role defined on the system.

Recommendations: For versions prior to 12.2, update to a version later than 12.2 to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-264

Related Identifiers

CVE-2018-0317

Affected Products

Cisco Prime Collaboration Provisioning

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-0317 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-bypass · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0317 · Vendor Advisory
• http://securitytracker.com/id/1041080 · Note
• http://securityfocus.com/bid/104432 · Note