Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-15379 — Incorrect Permission Assignment in Cisco Prime Infrastructure

CWE-275CWE-732 — Incorrect Permission Assignment6 documents6 sources
Severity
9.8CRITICALNVD
EPSS
89.6%
top 0.44%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Cisco Prime InfrastructureCisco Prime Infrastructure
Timeline
PublishedOct 5
Latest updateMay 13

Description

A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated, remote attacker to upload an arbitrary file. This file could allow the attacker to execute commands at the privilege level of the user prime. This user does not have administrative or root privileges. The vulnerability is due to an incorrect permission setting for important system directories. An attacker could exploit this vulnerability by uploa…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDcisco/prime_infrastructure9 versions+8

🔴Vulnerability Details

2
GHSA
GHSA-h92j-m24w-8xp7: A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated↗2022-05-13
▶
CVEList
Cisco Prime Infrastructure Arbitrary File Upload and Command Execution Vulnerability↗2018-10-05
▶

💥Exploits & PoCs

1
Exploit-DB
Cisco Prime Infrastructure - (Unauthenticated) Remote Code Execution↗2018-10-04
▶

📋Vendor Advisories

1
Cisco
Cisco Prime Infrastructure Arbitrary File Upload and Command Execution Vulnerability↗2018-10-03
▶

🕵️Threat Intelligence

1
Tenable
Public Exploit Modules Available for Cisco Prime Infrastructure Vulnerability↗2018-10-12
▶
CVE-2018-15379 — Incorrect Permission Assignment | cvebase