4.3med
CVE-2018-15433
Cisco Prime Infrastructure Information Disclosure Vulnerability
Published 8 y ago · modified 4 mo ago · JSON
CVSS
4.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 63%
Public exploits
0
none known
Summary
A vulnerability in the server backup function of Cisco Prime Infrastructure could allow an authenticated, remote attacker to view sensitive information. The vulnerability is due to the transmission of sensitive information as part of a GET request. An attacker could exploit this vulnerability by sending a GET request to a vulnerable device. A successful exploit could allow the attacker to view sensitive information.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction (EPSS)
1.01% probability of exploitation in the next 30 days, higher than 63% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Affected products
- Cisco Cisco Prime Infrastructure
Classification
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- securityfocus.com /bid/105562 · vdb-entry, x_refsource_BID, x_transferred
- tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-prime-id · vendor-advisory, x_refsource_CISCO, x_transferred
Sources
- CVE List: CVE-2018-15433
- NVD: CVE-2018-15433
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.