CVE-2018-0266

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of database tables over the web interface. An attacker could exploit this vulnerability by browsing to a specific URL. An exploit could allow the attacker to view configuration parameters. Cisco Bug IDs: CSCvf20218.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-425

Affected software

Vendor	Product	Versions
n/a	Cisco Unified Communications Manager	Cisco Unified Communications Manager

References

http://www.securityfocus.com/bid/103933Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040718Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-ucmVendor Advisory
http://www.securityfocus.com/bid/103933Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040718Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-ucmVendor Advisory

Timeline

Published: Apr 19, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-02676.5A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, local attacker to view sensitive CVE-2018-026810.0A vulnerability in the container management subsystem of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, rem CVE-2018-02694.3A vulnerability in the web framework of the Cisco Digital Network Architecture Center (DNA Center) could allow an unauthenticated, remote at CVE-2018-02708.8A vulnerability in the web-based management interface of Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote a CVE-2018-02719.8A vulnerability in the API gateway of the Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to CVE-2018-02725.9A vulnerability in the Secure Sockets Layer (SSL) Engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker CVE-2018-02735.3A vulnerability in the IPsec Manager of Cisco StarOS for Cisco Aggregation Services Router (ASR) 5000 Series Routers and Virtualized Packet CVE-2018-02748.8A vulnerability in the CLI parser of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to execute arbi CVE-2018-02756.7A vulnerability in the support tunnel feature of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to access CVE-2018-02766.1A vulnerability in Cisco WebEx Connect IM could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack aga CVE-2018-02778.6A vulnerability in the Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) certificate validation during EAP authenticatio CVE-2018-02786.5A vulnerability in the management console of Cisco Firepower System Software could allow an unauthenticated, remote attacker to access sensi