CVE-2018-0374 Missing authorization in Cisco Policy Suite unknown

Critical 9.8 Published 18 Jul 2018 Updated 29 Nov 2024

Unauthenticated remote attackers can access and modify any data in the Cisco Policy Suite database due to missing authentication controls.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-0374?

CVE-2018-0374 is a critical missing authorization vulnerability in Cisco Policy Suite unknown, published on 18 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the Policy Builder database of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to connect directly to the Policy Builder database. The vulnerability is due to a lack of authentication. An attacker could exploit this vulnerability by connecting directly to the Policy Builder database. A successful exploit could allow the attacker to access and change any data in the Policy Builder database. Cisco Bug IDs: CSCvh06134.

Weakness: CWE-306

Which versions are affected by CVE-2018-0374?

It affects 1 product.

Products include Cisco Mobility Services Engine.

How do I fix CVE-2018-0374?

No fix has been published for CVE-2018-0374 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2018-0374 being exploited?

There is no known exploitation of CVE-2018-0374 in the wild and no public exploit code.

Sources

Also known as GHSA-p7mr-mfc2-48qw.