Details of VAR-201807-0434

ID

VAR-201807-0434

CVE

CVE-2018-0393

TITLE

Cisco Policy Suite Authorization vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-008393

DESCRIPTION

A Read-Only User Effect Change vulnerability in the Policy Builder interface of Cisco Policy Suite could allow an authenticated, remote attacker to make policy changes in the Policy Builder interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by accessing the Policy Builder interface and modifying an HTTP request. A successful exploit could allow the attacker to make changes to existing policies. Cisco Bug IDs: CSCvi35007. Vendors have confirmed this vulnerability Bug ID CSCvi35007 It is released as.Information may be tampered with. Successfully exploiting this issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions. This solution provides functions such as user-based business rules, real-time management of applications and network resources

Trust: 1.98

sources: NVD: CVE-2018-0393 // JVNDB: JVNDB-2018-008393 // BID: 104867 // VULHUB: VHN-118595

AFFECTED PRODUCTS

vendor:	cisco	model:	mobility services engine 3365	scope:	eq	version:	18.0.0	Trust: 1.6
vendor:	cisco	model:	mobility services engine 3355	scope:	eq	version:	18.0.0	Trust: 1.6
vendor:	cisco	model:	mobility services engine 3310	scope:	eq	version:	18.0.0	Trust: 1.6
vendor:	cisco	model:	3310 series mobility service engine	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	3355 series mobility service engine	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	3365 series mobility service engine	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	policy suite	scope:	eq	version:	0	Trust: 0.3

sources: BID: 104867 // JVNDB: JVNDB-2018-008393 // CNNVD: CNNVD-201807-1290 // NVD: CVE-2018-0393

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-0393
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2018-0393
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201807-1290
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-118595
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-0393
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-118595
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-0393
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-118595 // JVNDB: JVNDB-2018-008393 // CNNVD: CNNVD-201807-1290 // NVD: CVE-2018-0393

PROBLEMTYPE DATA

problemtype:	CWE-285	Trust: 1.9
problemtype:	NVD-CWE-noinfo	Trust: 1.0

sources: VULHUB: VHN-118595 // JVNDB: JVNDB-2018-008393 // NVD: CVE-2018-0393

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201807-1290

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201807-1290

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-008393

PATCH

title:	cisco-sa-20180718-policy-suite-change	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-policy-suite-change	Trust: 0.8
title:	Cisco Policy Suite Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=82191	Trust: 0.6

sources: JVNDB: JVNDB-2018-008393 // CNNVD: CNNVD-201807-1290

EXTERNAL IDS

db:	NVD	id:	CVE-2018-0393	Trust: 2.8
db:	BID	id:	104867	Trust: 2.0
db:	JVNDB	id:	JVNDB-2018-008393	Trust: 0.8
db:	CNNVD	id:	CNNVD-201807-1290	Trust: 0.7
db:	VULHUB	id:	VHN-118595	Trust: 0.1

sources: VULHUB: VHN-118595 // BID: 104867 // JVNDB: JVNDB-2018-008393 // CNNVD: CNNVD-201807-1290 // NVD: CVE-2018-0393

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20180718-policy-suite-change	Trust: 2.0
url:	http://www.securityfocus.com/bid/104867	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0393	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-0393	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: VULHUB: VHN-118595 // BID: 104867 // JVNDB: JVNDB-2018-008393 // CNNVD: CNNVD-201807-1290 // NVD: CVE-2018-0393

CREDITS

Cisco.

Trust: 0.3

sources: BID: 104867

SOURCES

db:	VULHUB	id:	VHN-118595
db:	BID	id:	104867
db:	JVNDB	id:	JVNDB-2018-008393
db:	CNNVD	id:	CNNVD-201807-1290
db:	NVD	id:	CVE-2018-0393

LAST UPDATE DATE

2024-11-23T22:38:07.114000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-118595	date:	2019-10-09T00:00:00
db:	BID	id:	104867	date:	2018-07-18T00:00:00
db:	JVNDB	id:	JVNDB-2018-008393	date:	2018-10-16T00:00:00
db:	CNNVD	id:	CNNVD-201807-1290	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-0393	date:	2024-11-21T03:38:08.140

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-118595	date:	2018-07-18T00:00:00
db:	BID	id:	104867	date:	2018-07-18T00:00:00
db:	JVNDB	id:	JVNDB-2018-008393	date:	2018-10-16T00:00:00
db:	CNNVD	id:	CNNVD-201807-1290	date:	2018-07-19T00:00:00
db:	NVD	id:	CVE-2018-0393	date:	2018-07-18T23:29:01.180