cisco-sa-20180718-policy-suite-data: Cisco Policy Suite World-Readable Sensitive Data Vulnerability
First published: Wed Jul 18 2018(Updated: )
A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions. An attacker could exploit this vulnerability by logging in to the CLI. An exploit could allow the attacker to access potentially sensitive files that are owned by a different user. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-policy-suite-data
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Policy Suite Software |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of Cisco-SA-20180718-Policy-Suite-Data?
The severity of Cisco-SA-20180718-Policy-Suite-Data is classified as a high-risk vulnerability due to its potential impact on user data confidentiality.
How do I fix Cisco-SA-20180718-Policy-Suite-Data?
To mitigate Cisco-SA-20180718-Policy-Suite-Data, apply the latest software patch provided by Cisco for Policy Suite.
Who is affected by Cisco-SA-20180718-Policy-Suite-Data?
Cisco-SA-20180718-Policy-Suite-Data affects users of Cisco Policy Suite who have access to the CLI.
What is the nature of the vulnerability in Cisco-SA-20180718-Policy-Suite-Data?
The vulnerability in Cisco-SA-20180718-Policy-Suite-Data is due to insufficient access control permissions that allow unauthorized file access.
Can the Cisco-SA-20180718-Policy-Suite-Data vulnerability be exploited remotely?
No, the Cisco-SA-20180718-Policy-Suite-Data vulnerability requires local access to the CLI to be exploited.
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- collector/cisco-advisory
- source/Cisco
- agent/weakness
- agent/title
- agent/severity
- agent/references
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco policy suite software