{"schemaVersion":3,"id":"CVE-2018-0266","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of database tables over the web interface. An attacker could exploit this vulnerability by browsing to a specific URL. An exploit could allow the attacker to view configuration parameters. Cisco Bug IDs: CSCvf20218.","dates":{"published":"2018-04-19T20:00:00.000Z","modified":"2024-11-29T15:15:07.635Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4,"severity":"medium","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01709,"percentile":0.7695,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":-0.010999999999999899,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.0172},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01709,"percentile":0.7695}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0172,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01709,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01709,"percentile":0.7695}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/200.html"},{"id":"CWE-425","name":"Direct Request ('Forced Browsing')","description":"The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/425.html"}],"affected":[{"vendor":"cisco","product":"unified_communications_manager","name":"Unified Communications Manager","label":"unified_communications_manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"10.5\\(2.10000.5\\)","noFixRecorded":false,"fixedIn":null},{"text":"11.0\\(1.10000.10\\)","noFixRecorded":false,"fixedIn":null},{"text":"11.5\\(1.10000.6\\)","noFixRecorded":false,"fixedIn":null},{"text":"12.0\\(1.10000.10\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"10.5\\(2.10000.5\\) | 11.0\\(1.10000.10\\) | 11.5\\(1.10000.6\\) | 12.0\\(1.10000.10\\)","eol":null,"hubHref":"/vendor/cisco/unified_communications_manager"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-ucm","label":"tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-ucm","hostname":"tools.cisco.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/103933","label":"www.securityfocus.com/bid/103933","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id/1040718","label":"www.securitytracker.com/id/1040718","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-04-19T20:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-11-29T15:15:07.635Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":18,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T02:38:01.364Z","stale":false,"partial":false}}