CVE-2018-0377
A vulnerability in the Open Systems Gateway initiative (OSGi) interface of Cisco Policy Suite before 18.1.0 could allow an unauthenticated,…
Published 8 y ago · modified 4 mo ago · JSON
Summary
A vulnerability in the Open Systems Gateway initiative (OSGi) interface of Cisco Policy Suite before 18.1.0 could allow an unauthenticated, remote attacker to directly connect to the OSGi interface. The vulnerability is due to a lack of authentication. An attacker could exploit this vulnerability by directly connecting to the OSGi interface. An exploit could allow the attacker to access or change any files that are accessible by the OSGi process. Cisco Bug IDs: CSCvh18017.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 23 mo ago
Exploit prediction (EPSS)
2.62% probability of exploitation in the next 30 days, higher than 86% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- n/a Cisco Policy Suite unknown
Classification
- Weakness
- CWE-306 Missing Authentication for Critical Functionality
References
- tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-ps-osgi-unauth-access · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/104850 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2018-0377
- NVD: CVE-2018-0377
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.