CVE-2018-0323: Path Traversal

Published May 17, 2018

Updated

A vulnerability in the web management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a path traversal attack on a targeted system. The vulnerability is due to insufficient validation of web request parameters. An attacker who has access to the web management interface of the affected application could exploit this vulnerability by sending a malicious web request to the affected device. A successful exploit could allow the attacker to access sensitive information on the affected system. Cisco Bug IDs: CSCvh99631.

Affected Software

2 affected components

Cisco Network Functions Virtualization Infrastructure=3.6.1

Cisco Network Functions Virtualization Infrastructure=3.7.1

Event History

May 17, 2018

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-0323?

CVE-2018-0323 has been classified as a high severity vulnerability due to its potential impact on system security.

How do I fix CVE-2018-0323?

To remediate CVE-2018-0323, update to Cisco Enterprise NFV Infrastructure Software version 3.7.2 or later.

Who is affected by CVE-2018-0323?

CVE-2018-0323 affects users of Cisco Enterprise NFV Infrastructure Software versions 3.6.1 and 3.7.1.

What type of attack can be conducted with CVE-2018-0323?

CVE-2018-0323 allows an authenticated remote attacker to perform a path traversal attack.

How does CVE-2018-0323 exploit web request parameters?

CVE-2018-0323 exploits insufficient validation of web request parameters in the web management interface.