PT-2018-8764 · Cisco · Cisco Prime Collaboration Provisioning

Published 2018-06-07 · Updated 2019-10-09 · CVE-2018-0336

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Prime Collaboration Provisioning (affected versions not specified)

Description A vulnerability in the batch provisioning feature could allow an authenticated, remote attacker to escalate privileges to the Administrator level. This issue is due to insufficient authorization enforcement on batch processing. An attacker could exploit this by uploading a batch file and having it processed by the system, potentially allowing them to escalate privileges to the Administrator level.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

CWE-264

Related Identifiers

CVE-2018-0336

Affected Products

Cisco Prime Collaboration Provisioning

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-0336 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-escalation · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0336 · Vendor Advisory
• http://securitytracker.com/id/1041083 · Note
• http://securityfocus.com/bid/104429 · Note