CVE-2018-15466
Cisco Policy Suite Graphite Unauthenticated Read-Only Access Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in the Graphite web interface of the Policy and Charging Rules Function (PCRF) of Cisco Policy Suite (CPS) could allow an unauthenticated, remote attacker to access the Graphite web interface. The attacker would need to have access to the internal VLAN where CPS is deployed. The vulnerability is due to lack of authentication. An attacker could exploit this vulnerability by directly connecting to the Graphite web interface. An exploit could allow the attacker to access various statistics and Key Performance Indicators (KPIs) regarding the Cisco Policy Suite environment.
Una vulnerabilidad en la interfaz web Graphite del PCRF (Policy and Charging Rules Function) de Cisco Policy Suite (CPS) podría permitir que un atacante remoto no autenticado acceda a la interfaz web de Graphite. El atacante necesitaría contar con acceso a la VLAN interna donde está desplegado CPS. Esta vulnerabilidad se debe a la falta de autenticación. Un atacante podría explotar esta vulnerabilidad conectándose directamente a la interfaz web de Graphite. Su explotación podría permitir que el atacante acceda a varias estadísticas y KPI, o Indicadores Clave de Rendimiento, relacionados con el entorno de Cisco Policy Suite.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2018-08-17 CVE Reserved
- 2019-01-11 CVE Published
- 2024-11-19 CVE Updated
- 2024-11-20 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-284: Improper Access Control
- CWE-306: Missing Authentication for Critical Function
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/bid/106517 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Policy Suite For Mobile Search vendor "Cisco" for product "Policy Suite For Mobile" | 12.0.0 Search vendor "Cisco" for product "Policy Suite For Mobile" and version "12.0.0" | - |
Affected
|