What’s Vulnerable › Vulnerabilities

CVE-2018-0267

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-04-19 · updated 2026-06-17
• Weakness: CWE-200

Description

A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, local attacker to view sensitive data that should be restricted. This could include LDAP credentials. The vulnerability is due to insufficient protection of database tables over the web interface. An attacker could exploit this vulnerability by browsing to a specific URL. An exploit could allow the attacker to view sensitive information that should have been restricted. Cisco Bug IDs: CSCvf22116.

Affected products

• Cisco Unified Communications Manager: 10.5(2.10000.5), 11.0(1.10000.10), 11.5(1.10000.6), 12.0(1.10000.10)

References

• http://www.securityfocus.com/bid/103937
• http://www.securitytracker.com/id/1040719
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-ucm1
• http://www.securityfocus.com/bid/103937
• http://www.securitytracker.com/id/1040719
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-ucm1

Get alerted when CVE-2018-0267 or the next vulnerability affects your stack