Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-0096: Cisco Prime Infrastructure lets one virtual domain user alter another

CVE-2018-0096 · published 8 years ago

Summary

Cisco Prime Infrastructure does not correctly enforce role limits between virtual domains, so a user who is signed in can change the settings of a different virtual domain. This could let an attacker view or modify configurations they should not reach. Apply the latest Cisco update or follow Cisco’s guidance to tighten access controls.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
cisco	prime_infrastructure	3.2\(0.0\) 3.3\(0.0\) `cpe:2.3:a:cisco:prime_infrastructure:3.2\(0.0\):::::::*`

Original advisory text

A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to perform a privilege escalation in which one virtual domain user can view and modify another virtual domain configuration. The vulnerability is due to a failure to properly enforce RBAC for virtual domains. An attacker could exploit this vulnerability by sending an authenticated, crafted HTTP request to a targeted application. An exploit could allow the attacker to bypass RBAC policies on the targeted system to modify a virtual domain and access resources that are not normally accessible. Cisco Bug IDs: CSCvg36875.

References

http://www.securityfocus.com/bid/102727 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040242 Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

5.9 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-264Permissions, Privileges, and Access Controls

CWE-863Incorrect Authorization

Timeline

Published18 Jan 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-0096 · NVD

Track software like this

Free during beta