CVE-2018-0137

{"id": "CVE-2018-0137", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2018-02-08T07:29:00.947", "references": [{"url": "http://www.securityfocus.com/bid/102955", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-cpn", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-399"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the TCP throttling process of Cisco Prime Network could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient rate limiting protection for TCP listening ports. An attacker could exploit this vulnerability by sending the affected device a high rate of TCP SYN packets to the local IP address of the targeted application. A successful exploit could allow the attacker to cause the device to consume a high amount of memory and become slow, or to stop accepting new TCP connections to the application. Cisco Bug IDs: CSCvg48152."}, {"lang": "es", "value": "Una vulnerabilidad en el proceso de limitaci\u00f3n TCP en Cisco Prime Network podr\u00eda permitir que un atacante remoto sin autenticar provoque una denegaci\u00f3n de servicio (DoS) en un sistema afectado. Esta vulnerabilidad se debe a una protecci\u00f3n de l\u00edmite de tasa insuficiente para los puertos TCP en escucha. Un atacante podr\u00eda explotar esta vulnerabilidad enviando al dispositivo afectado un gran n\u00famero de paquetes SYN TCP a la direcci\u00f3n IP local de la aplicaci\u00f3n objetivo. Un exploit con \u00e9xito podr\u00eda permitir que el atacante provoque que el dispositivo consuma una gran cantidad de memoria y se vuelva lento o que deje de aceptar nuevas conexiones TCP en la aplicaci\u00f3n. Cisco Bug IDs: CSCvg48152."}], "lastModified": "2019-10-09T23:31:18.473", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:prime_network:4.3\\(0.0\\)pp6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ACA6DF35-696F-4453-9B26-9E37BCC65E97"}, {"criteria": "cpe:2.3:a:cisco:prime_network:4.3\\(2.0\\)pp1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FA3CA8B-C965-4F4B-A5ED-78181BAC9B50"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}