CVE-2018-15450 Cisco Prime Collaboration Assurance File Overwrite Vulnerability

What is CVE-2018-15450?

CVE-2018-15450 is a medium-severity path traversal vulnerability in Cisco Prime Collaboration Assurance, published on 8 Nov 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the web-based UI of Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to overwrite files on the file system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using a specific UI input field to provide a custom path location. A successful exploit could allow the attacker to overwrite files on the file system.

Weakness: CWE-22, CWE-20

Which versions are affected by CVE-2018-15450?

It affects 1 product.

Products include Cisco Prime Collaboration.

How do I fix CVE-2018-15450?

No fix has been published for CVE-2018-15450 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2018-15450 being exploited?

There is no known exploitation of CVE-2018-15450 in the wild and no public exploit code.

Other vulnerabilities in Cisco Prime Collaboration Assurance

• CVE-2018-15389 Cisco Prime Collaboration Provisioning Intermittent Hard-Coded Password Vulnerability Critical 9.8
• CVE-2018-0318 Auth bypass in Cisco Prime Collaboration Provisioning unknown Critical 9.8
• CVE-2018-0319 Auth bypass in Cisco Prime Collaboration Provisioning unknown Critical 9.8
• CVE-2018-0320 SQL injection in Cisco Prime Collaboration Provisioning unknown Critical 9.8
• CVE-2018-0321 Auth bypass in Cisco Prime Collaboration Provisioning unknown Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-64rj-5cf2-pc5w.