CVE-2018-15445

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user.

Metrics

CVSS 3.0 8.0/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Nov 8, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-154467.5A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulneraCVE-2018-154479.8A vulnerability in the web framework code of Cisco Integrated Management Controller (IMC) Supervisor could allow an unauthenticated, remote CVE-2018-154487.5A vulnerability in the user management functions of Cisco Registered Envelope Service could allow an unauthenticated, remote attacker to disCVE-2018-154496.5A vulnerability in the web-based management interface of Cisco Video Surveillance Media Server could allow an unauthenticated, remote attackCVE-2018-15457.5IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) uses weaker than expected cryptographic algorithms that could allow an attackeCVE-2018-154506.5A vulnerability in the web-based UI of Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to overwrite files CVE-2018-154515.4A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conducCVE-2018-154526.7A vulnerability in the DLL loading component of Cisco Advanced Malware Protection (AMP) for Endpoints on Windows could allow an authenticateCVE-2018-154538.6A vulnerability in the Secure/Multipurpose Internet Mail Extensions (S/MIME) Decryption and Verification or S/MIME Public Key Harvesting feaCVE-2018-154548.6A vulnerability in the Session Initiation Protocol (SIP) inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco FirCVE-2018-154556.1A vulnerability in the logging component of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct cross-CVE-2018-154564.9A vulnerability in the Admin Portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view saved pass
CVE-2018-15445: High severity, CVSS 8.0 | Vulnix