CVE-2018-0146

{"id": "CVE-2018-0146", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2018-02-22T00:29:00.470", "references": [{"url": "http://www.securityfocus.com/bid/103122", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-dcaf1", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to improper CSRF protection by the affected application. An attacker could exploit this vulnerability by persuading a user of the affected application to click a malicious link. A successful exploit could allow the attacker to submit arbitrary requests and take unauthorized actions on behalf of the user. Cisco Bug IDs: CSCvg45114."}, {"lang": "es", "value": "Una vulnerabilidad en Cisco Data Center Analytics Framework podr\u00eda permitir que un atacante remoto no autenticado lleve a cabo un ataque de Cross-Site Request Forgery (CSRF) en un sistema afectado. La vulnerabilidad se debe a una protecci\u00f3n CSRF inadecuada por parte de la aplicaci\u00f3n afectada. Un atacante podr\u00eda explotar esta vulnerabilidad haciendo que un usuario de la aplicaci\u00f3n haga clic en un enlace malicioso. Si se explota esta vulnerabilidad con \u00e9xito, el atacante podr\u00eda enviar peticiones arbitrarias y realizar acciones no autorizadas en nombre del usuario. Cisco Bug IDs: CSCvg45114."}], "lastModified": "2019-10-09T23:31:19.333", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:data_center_analytics_framework:3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4BFFA11-37BC-41AB-A547-BDE4730E815D"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}