Cisco Enterprise NFV Infrastructure Software Denial of Service Vulnerability (Cisco Cisco Enterprise NFV Infrastructure Software)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.79 % · percentile 78 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- cisco
- NVD status
- Modified
Description
A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to cause an affected system to reboot or shut down. The vulnerability is due to insufficient server-side authorization checks. An attacker who is logged in to the web-based management interface as a low-privileged user could exploit this vulnerability by sending a crafted HTTP request. A successful exploit could allow the attacker to use the low-privileged user account to reboot or shut down the affected system.
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.8 | AV:N/AC:L/Au:S/C:N/I:N/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2018-1282
- GCVE · GCVE-0-2018-0459
Affected configurations (NVD CPE)
cpe:2.3:a:cisco:network_functions_virtualization_infrastructure:-:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Cisco · Cisco Enterprise NFV Infrastructure Software | affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |