CVE-2018-0317: cisco prime_collaboration
Vulnerability summary
CVE-2018-0317 is a high (CVSS 8.8) vulnerability in cisco prime_collaboration. EPSS estimates a 2.56% chance of exploitation in the next 30 days, higher than 84.8% of scored vulnerabilities.
Timeline
- 07-06-2018PublishedVulnerability first disclosed.
- 29-11-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the web interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenticated, remote attacker to escalate their privileges. The vulnerability is due to insufficient web portal access control checks. An attacker could exploit this vulnerability by modifying an access request. An exploit could allow the attacker to promote their account to any role defined on the system. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 12.2 and prior. Cisco Bug IDs: CSCvc90286.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.56%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
-0.05 pp
From 2.61% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Cisco2 products
1 vendor · 2 products
References
3 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-bypassX Refsource CONFIRMVendor Advisory