Vulnerability Details : CVE-2018-15402

A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks. The vulnerability is due to improper validation of Origin headers on HTTP requests within the management interface. An attacker could exploit this vulnerability by convincing a targeted user to follow a URL to a malicious website. An exploit could allow the attacker to take actions within the software with the privileges of the targeted user or gain access to sensitive information.
Published 2018-10-17 20:29:00
Updated 2019-10-09 23:35:32
Source Cisco Systems, Inc.
View at NVD,   CVE.org
Vulnerability category: Cross-site request forgery (CSRF)

Products affected by CVE-2018-15402

Exploit prediction scoring system (EPSS) score for CVE-2018-15402

EPSS FAQ
0.10%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 25 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-15402

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
6.8
 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P
8.6
6.4
 NIST
8.8
 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
2.8
5.9
 NIST
5.4
 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
2.8
2.5
 Cisco Systems, Inc.

CWE ids for CVE-2018-15402

  • The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
    Assigned by:
    • nvd@nist.gov (Primary)
    • ykramarz@cisco.com (Secondary)

References for CVE-2018-15402

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close