CVE-2018-15402: Cisco Enterprise NFV Infrastructure Software Cross-Site Request Forgery Vulnerability

Published Oct 17, 2018

Updated

A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks. The vulnerability is due to improper validation of Origin headers on HTTP requests within the management interface. An attacker could exploit this vulnerability by convincing a targeted user to follow a URL to a malicious website. An exploit could allow the attacker to take actions within the software with the privileges of the targeted user or gain access to sensitive information.

Affected Software

2 affected components

Cisco Enterprise Network Virtualization Software=nfvis-8.0

Cisco Enterprise Network Virtualization Software=nfvis-9.0

Event History

Oct 17, 2018

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2018-15402?

CVE-2018-15402 has a high severity rating due to its potential impact on Cisco NFVIS systems.

How do I fix CVE-2018-15402?

To fix CVE-2018-15402, upgrade to the latest version of Cisco NFVIS as recommended in Cisco's security advisory.

What causes CVE-2018-15402?

CVE-2018-15402 is caused by improper validation of Origin headers in HTTP requests within Cisco NFVIS.

Who is affected by CVE-2018-15402?

CVE-2018-15402 affects users of Cisco Enterprise NFV Infrastructure Software, specifically versions 8.0 and 9.0.

What type of attack does CVE-2018-15402 enable?

CVE-2018-15402 enables unauthenticated remote attackers to conduct cross-site request forgery (CSRF) attacks.