Vulnerability Details : CVE-2018-0096
A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to perform a privilege escalation in which one virtual domain user can view and modify another virtual domain configuration. The vulnerability is due to a failure to properly enforce RBAC for virtual domains. An attacker could exploit this vulnerability by sending an authenticated, crafted HTTP request to a targeted application. An exploit could allow the attacker to bypass RBAC policies on the targeted system to modify a virtual domain and access resources that are not normally accessible. Cisco Bug IDs: CSCvg36875.
Vulnerability category: Gain privilege
Products affected by CVE-2018-0096
- cpe:2.3:a:cisco:prime_infrastructure:3.2\(0.0\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:prime_infrastructure:3.3\(0.0\):*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-0096
0.11%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 43 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-0096
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.9
|
MEDIUM | AV:N/AC:M/Au:S/C:P/I:P/A:N |
6.8
|
4.9
|
NIST | |
5.9
|
MEDIUM | CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N |
0.7
|
5.2
|
NIST |
CWE ids for CVE-2018-0096
-
Assigned by: ykramarz@cisco.com (Secondary)
-
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-0096
-
http://www.securitytracker.com/id/1040242
Cisco Prime Infrastructure RBAC Bug Lets Remote Authenticated Virtual Domain Users Gain Elevated Privileges - SecurityTrackerThird Party Advisory;VDB Entry
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-cpi
Cisco Prime Infrastructure Privilege Escalation VulnerabilityVendor Advisory
-
http://www.securityfocus.com/bid/102727
Cisco Prime Infrastructure CVE-2018-0096 Privilege Escalation VulnerabilityThird Party Advisory;VDB Entry
Jump to