CVE-2018-0135

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability in Cisco Unified Communications Manager could allow an authenticated, remote attacker to access sensitive information on an affected system. The vulnerability exists because the affected software improperly validates user-supplied search input. An attacker could exploit this vulnerability by sending malicious requests to an affected system. A successful exploit could allow the attacker to retrieve sensitive information from the affected system. Cisco Bug IDs: CSCvf17644.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	Cisco Unified Communications Manager	Cisco Unified Communications Manager

References

http://www.securityfocus.com/bid/102964Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040343Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-ucmVendor Advisory
http://www.securityfocus.com/bid/102964Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040343Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-ucmVendor Advisory

Timeline

Published: Feb 8, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-01368.6A vulnerability in the IPv6 subsystem of Cisco IOS XR Software Release 5.3.4 for the Cisco Aggregation Services Router (ASR) 9000 Series cou CVE-2018-01378.6A vulnerability in the TCP throttling process of Cisco Prime Network could allow an unauthenticated, remote attacker to cause a denial of se CVE-2018-01385.3A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass file po CVE-2018-01398.6A vulnerability in the Interactive Voice Response (IVR) management connection interface for Cisco Unified Customer Voice Portal (CVP) could CVE-2018-01406.5A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an auth CVE-2018-01418.4A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to th CVE-2018-01446.1A vulnerability in the web-based management interface of Cisco Prime Data Center Network Manager could allow an unauthenticated, remote atta CVE-2018-01456.1A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticate CVE-2018-01465.4A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a cross-CVE-2018-01479.8A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthe CVE-2018-01488.8A vulnerability in the web-based management interface of Cisco UCS Director Software and Cisco Integrated Management Controller (IMC) Superv CVE-2018-01494.8A vulnerability in the web-based management interface of Cisco Integrated Management Controller Supervisor Software and Cisco UCS Director S