CVE-2018-0318
First published: Thu Jun 07 2018(Updated: )
A vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to insufficient validation of a password reset request. An attacker could exploit this vulnerability by submitting a password reset request and changing the password for any user on an affected system. An exploit could allow the attacker to gain administrative-level privileges on the affected system. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 11.6 and prior. Cisco Bug IDs: CSCvd07245.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Prime Collaboration | <=12.1 | |
| Cisco Prime Collaboration Provisioning | <=11.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Cisco Prime Collaboration Provisioning (PCP) vulnerability?
The vulnerability ID for this Cisco Prime Collaboration Provisioning (PCP) vulnerability is CVE-2018-0318.
What is the severity of CVE-2018-0318?
The severity of CVE-2018-0318 is critical, with a CVSS score of 9.8.
How does the vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) allow unauthorized access to the device?
The vulnerability is due to insufficient validation of a password reset request, allowing an unauthenticated, remote attacker to gain unauthorized access to the affected device.
Which versions of Cisco Prime Collaboration and Cisco Prime Collaboration Provisioning are affected?
Cisco Prime Collaboration versions up to and including 12.1, and Cisco Prime Collaboration Provisioning versions up to and including 11.6 are affected.
How can I fix CVE-2018-0318 in Cisco Prime Collaboration Provisioning?
To fix CVE-2018-0318 in Cisco Prime Collaboration Provisioning, update to a version that is not affected by the vulnerability.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/tags
- agent/description
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/cisco
- canonical/cisco prime collaboration
- version/cisco prime collaboration/12.1
- canonical/cisco prime collaboration provisioning
- version/cisco prime collaboration provisioning/11.6