CVE-2018-0267

Опубликовано: 19 апр. 2018

Источник: nvd

CVSS3: 6.5

CVSS2: 2.1

EPSS Низкий

Описание

A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, local attacker to view sensitive data that should be restricted. This could include LDAP credentials. The vulnerability is due to insufficient protection of database tables over the web interface. An attacker could exploit this vulnerability by browsing to a specific URL. An exploit could allow the attacker to view sensitive information that should have been restricted. Cisco Bug IDs: CSCvf22116.

Ссылки

http://www.securityfocus.com/bid/103937
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040719
Third Party Advisory
VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-ucm1
Vendor Advisory
http://www.securityfocus.com/bid/103937
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040719
Third Party Advisory
VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-ucm1
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cisco:unified_communications_manager:10.5\(2.10000.5\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:unified_communications_manager:11.0\(1.10000.10\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:unified_communications_manager:11.5\(1.10000.6\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:unified_communications_manager:12.0\(1.10000.10\):*:*:*:*:*:*:*

EPSS

Процентиль: 21%

0.00067

Низкий

6.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-200

CWE-425

Связанные уязвимости

GHSA-g7j8-f822-pgf4