CVEvulnerability

CVE-2018-0267

6.5 MEDIUM Published 2018-04-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-04-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200, CWE-425

Description

A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, local attacker to view sensitive data that should be restricted. This could include LDAP credentials. The vulnerability is due to insufficient protection of database tables over the web interface. An attacker could exploit this vulnerability by browsing to a specific URL. An exploit could allow the attacker to view sensitive information that should have been restricted. Cisco Bug IDs: CSCvf22116.

Affected configurations

• cisco unified communications manager 10.5\(2.10000.5\) • cisco unified communications manager 11.0\(1.10000.10\) • cisco unified communications manager 11.5\(1.10000.6\) • cisco unified communications manager 12.0\(1.10000.10\)

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-425 Direct Request weakness

References