CVE-2018-0336 json
A vulnerability in the batch provisioning feature of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker t…
published 2018-06-07 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-1159
- cvss
- 8.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.3%
- EPSS 2.3% chance of exploitation in 30 days, percentile 83%
- public exploits
- 0
- none known
Summary
A vulnerability in the batch provisioning feature of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to escalate privileges to the Administrator level. The vulnerability is due to insufficient authorization enforcement on batch processing. An attacker could exploit this vulnerability by uploading a batch file and having the batch file processed by the system. A successful exploit could allow the attacker to escalate privileges to the Administrator level. Cisco Bug IDs: CSCvd86578.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 23 mo ago
Exploit prediction
2.34% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- n/a Cisco Prime Collaboration Provisioning unknown
Classification
References
-
tools.cisco.com
/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-escalation
vendor-advisory
-
securityfocus.com
/bid/104429
vdb-entry, third-party-advisory
-
securitytracker.com
/id/1041083
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2018-0336
- NVD CVE-2018-0336
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.