CVE-2018-0323

{"id": "CVE-2018-0323", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2018-05-17T03:29:00.717", "references": [{"url": "http://www.securityfocus.com/bid/104206", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-nfvis-path-traversal", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a path traversal attack on a targeted system. The vulnerability is due to insufficient validation of web request parameters. An attacker who has access to the web management interface of the affected application could exploit this vulnerability by sending a malicious web request to the affected device. A successful exploit could allow the attacker to access sensitive information on the affected system. Cisco Bug IDs: CSCvh99631."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de gesti\u00f3n web de Cisco Enterprise NFV Infrastructure Software (NFVIS) podr\u00eda permitir que un atacante remoto autenticado lleve a cabo un ataque de salto de directorio contra un sistema afectado. Esta vulnerabilidad se debe a una validaci\u00f3n insuficiente de los par\u00e1metros de petici\u00f3n web. Un atacante que tenga acceso a la interfaz de gesti\u00f3n web de la aplicaci\u00f3n afectada podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de una petici\u00f3n web maliciosa al dispositivo afectado. Su explotaci\u00f3n con \u00e9xito podr\u00eda permitir que el atacante acceda a informaci\u00f3n sensible del sistema afectado. Cisco Bug IDs: CSCvh99631."}], "lastModified": "2019-10-09T23:31:46.317", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:network_functions_virtualization_infrastructure:3.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0973CD91-EAA5-4D6B-B93F-3FDB3ACD1FA7"}, {"criteria": "cpe:2.3:a:cisco:network_functions_virtualization_infrastructure:3.7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4BBC296-B394-4B88-B0D3-080FD00FA180"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}