CVE-2018-0323
A vulnerability in the web management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remot…
Published 8 y ago · modified 4 mo ago · JSON
Summary
A vulnerability in the web management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a path traversal attack on a targeted system. The vulnerability is due to insufficient validation of web request parameters. An attacker who has access to the web management interface of the affected application could exploit this vulnerability by sending a malicious web request to the affected device. A successful exploit could allow the attacker to access sensitive information on the affected system. Cisco Bug IDs: CSCvh99631.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction (EPSS)
1.78% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Affected products
- n/a Cisco Enterprise NFV Infrastructure Software
Classification
- Weakness
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
- tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-nfvis-path-traversal · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/104206 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2018-0323
- NVD: CVE-2018-0323
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.