CVE-2018-0448

{"id": "CVE-2018-0448", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2018-10-05T14:29:02.920", "references": [{"url": "http://www.securityfocus.com/bid/105502", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-dna-auth-bypass", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-326"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-326"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the identity management service of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and take complete control of identity management functions. The vulnerability is due to insufficient security restrictions for critical management functions. An attacker could exploit this vulnerability by sending a valid identity management request to the affected system. An exploit could allow the attacker to view and make unauthorized modifications to existing system users as well as create new users."}, {"lang": "es", "value": "Una vulnerabilidad en el servicio de gesti\u00f3n de identidades de Cisco Digital Network Architecture (DNA) Center podr\u00eda permitir que un atacante remoto no autenticado omita la autenticaci\u00f3n y tome el control total de las funciones de gesti\u00f3n de identidades. Esta vulnerabilidad se debe a restricciones de seguridad insuficientes para las funciones de gesti\u00f3n cr\u00edticas. Un atacante podr\u00eda explotar esta vulnerabilidad enviando una petici\u00f3n de gesti\u00f3n de identidades v\u00e1lida a un dispositivo afectado. Su explotaci\u00f3n podr\u00eda permitir que el atacante visualice y realice modificaciones no autorizadas a los usuarios del sistema existentes, as\u00ed como crear nuevos usuarios."}], "lastModified": "2020-08-12T12:57:44.773", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:digital_network_architecture_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9008BC0-71D8-4CB3-B4E5-E8B4BA16F7DB", "versionEndExcluding": "1.1.4"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}