CVE-2018-0474 Cisco Unified Communications Manager Digest Credentials Disclosure Vulnerability

Medium 4.3 Published 10 Jan 2019 Updated 21 Nov 2024

Authenticated attackers can view clear-text digest credentials in the web management interface, potentially leading to account takeover.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-0474?

CVE-2018-0474 is a medium-severity vulnerability in Cisco Unified Communications Manager, published on 10 Jan 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view digest credentials in clear text. The vulnerability is due to the incorrect inclusion of saved passwords in configuration pages. An attacker could exploit this vulnerability by logging in to the Cisco Unified Communications Manager web-based management interface and viewing the source code for the configuration page. A successful exploit could allow the attacker to recover passwords and expose those accounts to further attack.

Weakness: CWE-522, CWE-200

Which versions are affected by CVE-2018-0474?

It affects 1 product.

Products include Cisco Unified Communications Manager.

How do I fix CVE-2018-0474?

No fix has been published for CVE-2018-0474 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-0474 being exploited?

There is no known exploitation of CVE-2018-0474 in the wild and no public exploit code.

All Cisco Unified Communications Manager vulnerabilities

Sources

Also known as GHSA-rf5j-69h6-8rvq.