Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

Cisco Data Center Analytics Framework lets remote attacker forge requests

CVE-2018-0146 · published 8 years ago
Summary

The Cisco Data Center Analytics Framework web interface does not properly stop forged web requests. An attacker could send a malicious link to a user, and if the user clicks it, the attacker could perform actions in the system as if they were the user. Apply the latest Cisco update and educate users to avoid clicking unexpected links.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
cisco data_center_analytics_framework 3.1
cpe:2.3:a:cisco:data_center_analytics_framework:3.1:*:*:*:*:*:*:*
Original advisory text
A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system....
A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to improper CSRF protection by the affected application. An attacker could exploit this vulnerability by persuading a user of the affected application to click a malicious link. A successful exploit could allow the attacker to submit arbitrary requests and take unauthorized actions on behalf of the user. Cisco Bug IDs: CSCvg45114.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published22 Feb 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-0146 · NVD
Track software like this
Free during beta