CVE-2018-0269: cisco digital_network_architecture_center
Vulnerability summary
CVE-2018-0269 is a medium (CVSS 4.3) vulnerability in cisco digital_network_architecture_center. EPSS estimates a 1.26% chance of exploitation in the next 30 days, higher than 69.2% of scored vulnerabilities.
Timeline
- 19-04-2018PublishedVulnerability first disclosed.
- 29-11-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the web framework of the Cisco Digital Network Architecture Center (DNA Center) could allow an unauthenticated, remote attacker to communicate with the Kong API server without restriction. The vulnerability is due to an overly permissive Cross Origin Resource Sharing (CORS) policy. An attacker could exploit this vulnerability by convincing a user to follow a malicious link. An exploit could allow the attacker to communicate with the API and exfiltrate sensitive information. Cisco Bug IDs: CSCvh99208.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.26%
Chance of exploitation in the next 30 days
Percentile
69%
Versus all other CVEs
30-day change
-0.01 pp
From 1.27% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Cisco1 product
1 vendor · 1 product
References
2 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-dna1X Refsource CONFIRMVendor Advisory