CVE-2018-0267

{"id": "CVE-2018-0267", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.0}]}, "published": "2018-04-19T20:29:01.533", "references": [{"url": "http://www.securityfocus.com/bid/103937", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1040719", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-ucm1", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-425"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, local attacker to view sensitive data that should be restricted. This could include LDAP credentials. The vulnerability is due to insufficient protection of database tables over the web interface. An attacker could exploit this vulnerability by browsing to a specific URL. An exploit could allow the attacker to view sensitive information that should have been restricted. Cisco Bug IDs: CSCvf22116."}, {"lang": "es", "value": "Una vulnerabilidad en el framework web de Cisco Unified Communications Manager podr\u00eda permitir que un atacante local autenticado visualice datos sensibles que deber\u00edan estar restringidos. Esto podr\u00eda incluir credenciales LDAP. Esta vulnerabilidad se debe a una protecci\u00f3n de tablas de bases de datos insuficiente en la interfaz web. Un atacante podr\u00eda explotar esta vulnerabilidad navegando hasta una URL espec\u00edfica. Su explotaci\u00f3n podr\u00eda permitir que el atacante vea informaci\u00f3n sensible que deber\u00eda estar restringida. Cisco Bug IDs: CSCvf22116."}], "lastModified": "2020-09-04T18:29:22.643", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:unified_communications_manager:10.5\\(2.10000.5\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "520555C7-5E9B-4C76-AAB5-5DD8B29D18F0"}, {"criteria": "cpe:2.3:a:cisco:unified_communications_manager:11.0\\(1.10000.10\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F47282B9-8B76-40E0-B72C-A6A196A37A0C"}, {"criteria": "cpe:2.3:a:cisco:unified_communications_manager:11.5\\(1.10000.6\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21BFC3A9-B6B1-49EE-A93A-6432BFE33E84"}, {"criteria": "cpe:2.3:a:cisco:unified_communications_manager:12.0\\(1.10000.10\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BA185BB-D78F-4F4E-B248-9AF550F0C4E0"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}