Lucene search

CiscoCVE-2018-0323

HistoryMay 17, 2018 - 3:29 a.m.

CVE-2018-0323

2018-05-1703:29:00

CWE-22

cisco

web.nvd.nist.gov

cisco

nfvis

vulnerability

web management interface

path traversal

remote attack

security

cve-2018-0323

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

47.2%

JSON

A vulnerability in the web management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a path traversal attack on a targeted system. The vulnerability is due to insufficient validation of web request parameters. An attacker who has access to the web management interface of the affected application could exploit this vulnerability by sending a malicious web request to the affected device. A successful exploit could allow the attacker to access sensitive information on the affected system. Cisco Bug IDs: CSCvh99631.

Affected configurations

Nvd

Node

cisconetwork_functions_virtualization_infrastructureMatch3.6.1

cisconetwork_functions_virtualization_infrastructureMatch3.7.1

VendorProductVersionCPE
cisconetwork_functions_virtualization_infrastructure3.6.1cpe:2.3:a:cisco:network_functions_virtualization_infrastructure:3.6.1:*:*:*:*:*:*:*
cisconetwork_functions_virtualization_infrastructure3.7.1cpe:2.3:a:cisco:network_functions_virtualization_infrastructure:3.7.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	network_functions_virtualization_infrastructure	3.6.1	cpe:2.3:a:cisco:network_functions_virtualization_infrastructure:3.6.1:::::::*
cisco	network_functions_virtualization_infrastructure	3.7.1	cpe:2.3:a:cisco:network_functions_virtualization_infrastructure:3.7.1:::::::*

CNA Affected

[
  {
    "product": "Cisco Enterprise NFV Infrastructure Software",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Enterprise NFV Infrastructure Software"
      }
    ]
  }
]

References

www.securityfocus.com/bid/104206

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-nfvis-path-traversal

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

47.2%

JSON

Related for CVE-2018-0323