CVE-2018-0338: Input Validation
First published: Thu Jun 07 2018(Updated: )
A vulnerability in the role-based access-checking mechanisms of Cisco Unified Computing System (UCS) Software could allow an authenticated, local attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software lacks proper input and validation checks for certain file systems. An attacker could exploit this vulnerability by issuing crafted commands in the CLI of an affected system. A successful exploit could allow the attacker to cause other users to execute unwanted arbitrary commands on the affected system. Cisco Bug IDs: CSCvf52994.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Computing System | =5.5\(203\) | |
| Cisco Unified Computing System | =7.0\(0\)bz\(0.46\) | |
| Cisco Unified Computing System | =9.0\(100.20\)b | |
| Cisco Unified Computing System | =9.1\(1.13\) | |
| Cisco Unified Computing System | =9.9\(0.902\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-0338?
CVE-2018-0338 is a vulnerability in the role-based access-checking mechanisms of Cisco Unified Computing System (UCS) Software that could allow an authenticated, local attacker to execute arbitrary commands on an affected system.
How does CVE-2018-0338 affect Cisco Unified Computing System (UCS) Software?
CVE-2018-0338 affects Cisco Unified Computing System (UCS) Software by lacking proper input and validation checks in its role-based access-checking mechanisms.
What is the severity of CVE-2018-0338?
The severity of CVE-2018-0338 is high with a CVSS score of 7.8.
How can an attacker exploit CVE-2018-0338?
An attacker with authenticated, local access can exploit CVE-2018-0338 to execute arbitrary commands on an affected system.
How can I fix CVE-2018-0338 in Cisco Unified Computing System (UCS) Software?
To fix CVE-2018-0338, Cisco has released a security advisory with patches and mitigations. Please refer to the Cisco Security Advisory for more information.
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/author
- agent/tags
- agent/type
- agent/event
- agent/references
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/cisco
- canonical/cisco unified computing system
- version/cisco unified computing system/5.5\(203\)
- version/cisco unified computing system/7.0\(0\)bz\(0.46\)
- version/cisco unified computing system/9.0\(100.20\)b
- version/cisco unified computing system/9.1\(1.13\)
- version/cisco unified computing system/9.9\(0.902\)