cisco-sa-20180606-prime-access: Cisco Prime Collaboration Provisioning Access Control Vulnerability
A vulnerability in the web management interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenticated, remote attacker to modify sensitive data that is associated with arbitrary accounts on an affected device. The vulnerability is due to a failure to enforce access restrictions on the Help Desk and User Provisioning roles that are assigned to authenticated users. This failure could allow an authenticated attacker to modify critical attributes of higher-privileged accounts on the device. A successful exploit could allow the attacker to gain elevated privileges on the device.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-access
Affected Software
Event History
Frequently Asked Questions
What is the severity of Cisco Security Advisory cisco-sa-20180606-prime-access?
The severity of Cisco Security Advisory cisco-sa-20180606-prime-access is high due to the potential for authenticated remote attackers to modify sensitive data.
How do I fix Cisco Security Advisory cisco-sa-20180606-prime-access?
To fix Cisco Security Advisory cisco-sa-20180606-prime-access, ensure you apply the latest patches and updates provided by Cisco for Prime Collaboration Provisioning.
What devices are affected by Cisco Security Advisory cisco-sa-20180606-prime-access?
Cisco Security Advisory cisco-sa-20180606-prime-access affects devices running the Cisco Prime Collaboration Provisioning software.
What type of exploit is associated with Cisco Security Advisory cisco-sa-20180606-prime-access?
The exploit associated with Cisco Security Advisory cisco-sa-20180606-prime-access allows authenticated remote attackers to modify sensitive data of arbitrary accounts.
Is authentication required to exploit the vulnerability in Cisco Security Advisory cisco-sa-20180606-prime-access?
Yes, an authenticated user must be present to exploit the vulnerability outlined in Cisco Security Advisory cisco-sa-20180606-prime-access.