CVE-2018-0211
published 2018-03-08CVE-2018-0211: A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a denial of service (DoS)…
PriorityP415medium4.4CVSS 3.0
AVLACLPRHUINSUCNINAH
EPSS
0.40%
32.1th percentile
A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a denial of service (DoS) condition. The device may need to be manually rebooted to recover. The vulnerability is due to lack of proper input validation of the CLI user input for certain CLI commands. An attacker could exploit this vulnerability by authenticating to the device and issuing a crafted, malicious CLI command on the targeted device. A successful exploit could allow the attacker to cause a DoS condition. The attacker must have valid administrative privileges on the device to exploit this vulnerability. Cisco Bug IDs: CSCvf63414, CSCvh51992.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | identity_services_engine | — | — |
| cisco | identity_services_engine | — | — |
| cisco | identity_services_engine | — | — |
| cisco | identity_services_engine_authenticated | — | — |
CVSS provenance
nvdv3.04.4MEDIUMCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:N/A:C
osv5.3MEDIUM
vendor_cisco4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Identity Services Engine Authenticated CLI Denial of Service Vulnerability
vendor_cisco·2018-03-07·CVSS 4.4
CVE-2018-0211 [MEDIUM] CWE-20 Cisco Identity Services Engine Authenticated CLI Denial of Service Vulnerability
Cisco Identity Services Engine Authenticated CLI Denial of Service Vulnerability
A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a denial of service (DoS) condition. The device may need to be manually rebooted to recover.
The vulnerability is due to lack of proper input validation of the CLI user input for certain CLI commands. An attacker could exploit this vulnerability by authenticating to the device and issuing a crafted, malicious CLI command on the targeted device. A successful exploit could allow the attacker to cause a DoS condition. The attacker must have valid administrative privileges on the device to exploit this vulnerability.
There are no workarounds that address this vulnerability.
This
Cisco
Cisco Identity Services Engine Authenticated CLI Denial of Service Vulnerability
vendor_cisco·CVSS 3.0
CVE-2018-0211 Cisco Identity Services Engine Authenticated CLI Denial of Service Vulnerability
CVE-2018-0211: Cisco Identity Services Engine Authenticated CLI Denial of Service Vulnerability
A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a denial of service (DoS) condition. The device may need to be manually rebooted to recover. The vulnerability is due to lack of proper input validation of the CLI user input for certain CLI commands. An attacker could exploit this vulnerability by authenticating to the device and issuing a crafted, malicious CLI command on the targeted device. A successful exploit could allow the attacker to cause a DoS condition. The attacker must have valid administrative privileges on the device to exploit this vulnerability. There are no
CVSS: 3.0
CWE: CWE-20, CWE-20
Bug IDs:
GHSA
GHSA-f978-vh2v-fvj4: A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a denial of serv
ghsa_unreviewed·2022-05-13
CVE-2018-0211 [MEDIUM] CWE-20 GHSA-f978-vh2v-fvj4: A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a denial of serv
A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a denial of service (DoS) condition. The device may need to be manually rebooted to recover. The vulnerability is due to lack of proper input validation of the CLI user input for certain CLI commands. An attacker could exploit this vulnerability by authenticating to the device and issuing a crafted, malicious CLI command on the targeted device. A successful exploit could allow the attacker to cause a DoS condition. The attacker must have valid administrative privileges on the device to exploit this vulnerability. Cisco Bug IDs: CSCvf63414, CSCvh51992.
OSV
apache2 vulnerabilities
osv·2019-04-04·CVSS 5.3
CVE-2019-0211 apache2 vulnerabilities
apache2 vulnerabilities
Charles Fol discovered that the Apache HTTP Server incorrectly handled the
scoreboard shared memory area. A remote attacker able to upload and run
scripts could possibly use this issue to execute arbitrary code with root
privileges. (CVE-2019-0211)
It was discovered that the Apache HTTP Server HTTP/2 module incorrectly
handled certain requests. A remote attacker could possibly use this issue
to cause the server to consume resources, leading to a denial of service.
This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10.
(CVE-2018-17189)
It was discovered that the Apache HTTP Server incorrectly handled session
expiry times. When used with mod_session_cookie, this may result in the
session expiry time to be ignored, contrary to expectations.
(CVE-2018-17199)
Cr
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/103334http://www.securitytracker.com/id/1040471https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-isehttp://www.securityfocus.com/bid/103334http://www.securitytracker.com/id/1040471https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise
2018-03-08
Published