CVE-2018-0394

{"id": "CVE-2018-0394", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2018-07-18T23:29:01.243", "references": [{"url": "http://www.securityfocus.com/bid/104881", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-csp2100-injection", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web upload function of Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to obtain restricted shell access on an affected system. The vulnerability is due to insufficient input validation of parameters passed to a specific function within the user interface. An attacker could exploit this vulnerability by injecting code into a function parameter. Cisco Bug IDs: CSCvi12935."}, {"lang": "es", "value": "Una vulnerabilidad en la funci\u00f3n de subida web de Cisco Cloud Services Platform 2100 podr\u00eda permitir que un atacante remoto autenticado obtenga acceso shell restringido en un sistema afectado. La vulnerabilidad se debe a una validaci\u00f3n de entrada insuficiente de par\u00e1metros que se pasan una funci\u00f3n espec\u00edfica de la interfaz de usuario. Un atacante podr\u00eda explotar esta vulnerabilidad inyectando c\u00f3digo en un par\u00e1metro de funci\u00f3n. Cisco Bug IDs: CSCvi12935."}], "lastModified": "2019-10-09T23:31:57.927", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:cloud_services_platform_2100:2.2\\(4\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C820C299-1C68-4A16-8EDF-72F2F855D733"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}