CVE-2018-15402CWE-352

Cisco Enterprise NFV Infrastructure Software Cross-Site Request Forgery Vulnerability

Medium · published October 17, 2018

CVSS v3.0
5.4
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks. The vulnerability is due to improper validation of Origin headers on HTTP requests within the management interface. An attacker could exploit this vulnerability by convincing a targeted user to follow a URL to a malicious website. An exploit could allow the attacker to take actions within the software with the privileges of the targeted user or gain access to sensitive information.

The record
Technical detail
CVSS v3.0
5.4 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00481 · 40.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2018-10-17T20:00Z
EPSS history
Timeline
  • 17 OCT 20:00Z
    Cisco Enterprise NFV Infrastructure Software Cross-Site Request Forgery Vulnerability
    cvelistv5