PT-2018-8751 · Cisco · Cisco Prime Collaboration Provisioning

Published 2018-06-07 · Updated 2019-10-09 · CVE-2018-0321

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Prime Collaboration Provisioning versions 11.6 and prior

Description A vulnerability in Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access the Java Remote Method Invocation (RMI) system due to an open port in the Network Interface and Configuration Engine (NICE) service. An attacker could exploit this vulnerability by accessing the open RMI system, allowing them to perform malicious actions that affect the system and connected devices.

Recommendations For versions 11.6 and prior, update to a version later than 11.6 to resolve the issue. As a temporary workaround, consider restricting access to the open RMI system in the NICE service to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-0321

Affected Products

Cisco Prime Collaboration Provisioning

References · 5

• https://osv.dev/vulnerability/CVE-2018-0321 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0321 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-rmi · Vendor Advisory
• http://securitytracker.com/id/1041085 · Note
• http://securityfocus.com/bid/104409 · Note