CVE-2018-0119
A vulnerability in certain authentication controls in the account services of Cisco Spark could allow an authenticated, remote attacker to…
Published 8 y ago · modified 4 mo ago · JSON
Summary
A vulnerability in certain authentication controls in the account services of Cisco Spark could allow an authenticated, remote attacker to interact with and view information on an affected device that would normally be prohibited. The vulnerability is due to the improper display of user-account tokens generated in the system. An attacker could exploit this vulnerability by logging in to the device with a token in use by another account. Successful exploitation could allow the attacker to cause a partial impact to the device's confidentiality, integrity, and availability. Cisco Bug IDs: CSCvg05206.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction (EPSS)
0.99% probability of exploitation in the next 30 days, higher than 63% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 4.7 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- n/a Cisco Spark
Classification
- Weakness
- CWE-284 Improper Access Control
References
- securityfocus.com /bid/102961 · vdb-entry, x_refsource_BID, x_transferred
- tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-spark · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-0119
- NVD: CVE-2018-0119
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.