CVE-2018-0107

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery (CSRF) protection. An attacker could exploit this vulnerability by tricking the user of a web application into executing an adverse action. Cisco Bug IDs: CSCvg30313.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jan 18, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-01085.3A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files via an out-of-band CVE-2018-01092.7A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to access sensitive data about the application.CVE-2018-01108.1A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to access the remote support account even afterCVE-2018-01115.3A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data about the applicatioCVE-2018-01129.0A vulnerability in Cisco WebEx Business Suite clients, Cisco WebEx Meetings, and Cisco WebEx Meetings Server could allow an authenticated, rCVE-2018-01138.8A vulnerability in an operations script of Cisco UCS Central could allow an authenticated, remote attacker to execute arbitrary shell commanCVE-2018-01147.5A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens uCVE-2018-01156.7A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series routers could allow an authenticated, local attackCVE-2018-01167.2A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to be authorized aCVE-2018-01178.6A vulnerability in the ingress packet processing functionality of the Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software cCVE-2018-01186.1A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attackeCVE-2018-01194.7A vulnerability in certain authentication controls in the account services of Cisco Spark could allow an authenticated, remote attacker to i
CVE-2018-0107: High severity, CVSS 8.8 | Vulnix