Vulnerability-Lookup

CNVD-2018-03429

Vulnerability from cnvd - Published: 2018-02-24

Title

Cisco Elastic Services Controller Software未授权访问漏洞

Description

Cisco Elastic Services Controller Software（ESC）是美国思科（Cisco）公司的一套开源的用于管理虚拟资源的模块化系统。service portal是其中的一个基于Web的业务系统门户。 Cisco ESC 3.0.0版本中基于Web的业务门户的JSON Web令牌使用存在未授权漏洞，该漏洞源于程序为基于Web的服务门户使用了静态的默认凭证。远程攻击攻击者可通过从受影响软件的图像中提取凭证，并使用这些凭证创建有效的管理会话令牌利用该漏洞获取基于Web服务门户的管理权限。

Severity

高

Patch Name

Cisco Elastic Services Controller Software未授权访问漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc1

Reference

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc1

Impacted products

Name
Cisco Elastic Services Controllers 3.0.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-0130"
    }
  },
  "description": "Cisco Elastic Services Controller Software\uff08ESC\uff09\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u7528\u4e8e\u7ba1\u7406\u865a\u62df\u8d44\u6e90\u7684\u6a21\u5757\u5316\u7cfb\u7edf\u3002service portal\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u57fa\u4e8eWeb\u7684\u4e1a\u52a1\u7cfb\u7edf\u95e8\u6237\u3002\r\n\r\nCisco ESC 3.0.0\u7248\u672c\u4e2d\u57fa\u4e8eWeb\u7684\u4e1a\u52a1\u95e8\u6237\u7684JSON Web\u4ee4\u724c\u4f7f\u7528\u5b58\u5728\u672a\u6388\u6743\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u4e3a\u57fa\u4e8eWeb\u7684\u670d\u52a1\u95e8\u6237\u4f7f\u7528\u4e86\u9759\u6001\u7684\u9ed8\u8ba4\u51ed\u8bc1\u3002\u8fdc\u7a0b\u653b\u51fb\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u4ece\u53d7\u5f71\u54cd\u8f6f\u4ef6\u7684\u56fe\u50cf\u4e2d\u63d0\u53d6\u51ed\u8bc1\uff0c\u5e76\u4f7f\u7528\u8fd9\u4e9b\u51ed\u8bc1\u521b\u5efa\u6709\u6548\u7684\u7ba1\u7406\u4f1a\u8bdd\u4ee4\u724c\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u57fa\u4e8eWeb\u670d\u52a1\u95e8\u6237\u7684\u7ba1\u7406\u6743\u9650\u3002",
  "discovererName": "Cisco",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc1",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-03429",
  "openTime": "2018-02-24",
  "patchDescription": "Cisco Elastic Services Controller Software\uff08ESC\uff09\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u7528\u4e8e\u7ba1\u7406\u865a\u62df\u8d44\u6e90\u7684\u6a21\u5757\u5316\u7cfb\u7edf\u3002service portal\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u57fa\u4e8eWeb\u7684\u4e1a\u52a1\u7cfb\u7edf\u95e8\u6237\u3002\r\n\r\nCisco ESC 3.0.0\u7248\u672c\u4e2d\u57fa\u4e8eWeb\u7684\u4e1a\u52a1\u95e8\u6237\u7684JSON Web\u4ee4\u724c\u4f7f\u7528\u5b58\u5728\u672a\u6388\u6743\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u4e3a\u57fa\u4e8eWeb\u7684\u670d\u52a1\u95e8\u6237\u4f7f\u7528\u4e86\u9759\u6001\u7684\u9ed8\u8ba4\u51ed\u8bc1\u3002\u8fdc\u7a0b\u653b\u51fb\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u4ece\u53d7\u5f71\u54cd\u8f6f\u4ef6\u7684\u56fe\u50cf\u4e2d\u63d0\u53d6\u51ed\u8bc1\uff0c\u5e76\u4f7f\u7528\u8fd9\u4e9b\u51ed\u8bc1\u521b\u5efa\u6709\u6548\u7684\u7ba1\u7406\u4f1a\u8bdd\u4ee4\u724c\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u57fa\u4e8eWeb\u670d\u52a1\u95e8\u6237\u7684\u7ba1\u7406\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco Elastic Services Controller Software\u672a\u6388\u6743\u8bbf\u95ee\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Cisco Elastic Services Controllers 3.0.0"
  },
  "referenceLink": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc1",
  "serverity": "\u9ad8",
  "submitTime": "2018-02-23",
  "title": "Cisco Elastic Services Controller Software\u672a\u6388\u6743\u8bbf\u95ee\u6f0f\u6d1e"
}

CVE-2018-0130 (GCVE-0-2018-0130)

Vulnerability from cvelistv5 – Published: 2018-02-22 00:00 – Updated: 2024-12-02 21:05

Summary

A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to gain administrative access to an affected system. The vulnerability is due to the presence of static default credentials for the web-based service portal of the affected software. An attacker could exploit this vulnerability by extracting the credentials from an image of the affected software and using those credentials to generate a valid administrative session token for the web-based service portal of any other installation of the affected software. A successful exploit could allow the attacker to gain administrative access to the web-based service portal of an affected system. This vulnerability affects Cisco Elastic Services Controller Software Release 3.0.0. Cisco Bug IDs: CSCvg30884.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-02 19:24 UTC

CWE

CWE-264

Assigner

cisco mitre root Scorecard

References

2 references

URL	Tags
http://www.securityfocus.com/bid/103116	vdb-entryx_refsource_BID
https://tools.cisco.com/security/center/content/C…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
n/a	Cisco Elastic Services Controller	Affected: Cisco Elastic Services Controller

Date Public

2018-02-21 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:14:16.814Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "103116",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/103116"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2018-0130",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-02T19:24:09.857667Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-02T21:05:57.650Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Elastic Services Controller",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Cisco Elastic Services Controller"
            }
          ]
        }
      ],
      "datePublic": "2018-02-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to gain administrative access to an affected system. The vulnerability is due to the presence of static default credentials for the web-based service portal of the affected software. An attacker could exploit this vulnerability by extracting the credentials from an image of the affected software and using those credentials to generate a valid administrative session token for the web-based service portal of any other installation of the affected software. A successful exploit could allow the attacker to gain administrative access to the web-based service portal of an affected system. This vulnerability affects Cisco Elastic Services Controller Software Release 3.0.0. Cisco Bug IDs: CSCvg30884."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-264",
              "description": "CWE-264",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-02-23T10:57:01.000Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "103116",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/103116"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2018-0130",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco Elastic Services Controller",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Cisco Elastic Services Controller"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to gain administrative access to an affected system. The vulnerability is due to the presence of static default credentials for the web-based service portal of the affected software. An attacker could exploit this vulnerability by extracting the credentials from an image of the affected software and using those credentials to generate a valid administrative session token for the web-based service portal of any other installation of the affected software. A successful exploit could allow the attacker to gain administrative access to the web-based service portal of an affected system. This vulnerability affects Cisco Elastic Services Controller Software Release 3.0.0. Cisco Bug IDs: CSCvg30884."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-264"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "103116",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/103116"
            },
            {
              "name": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc1",
              "refsource": "CONFIRM",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2018-0130",
    "datePublished": "2018-02-22T00:00:00.000Z",
    "dateReserved": "2017-11-27T00:00:00.000Z",
    "dateUpdated": "2024-12-02T21:05:57.650Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2018-03429

CVE-2018-0130 (GCVE-0-2018-0130)

Tags

Sightings

Nomenclature

Related by attack behaviour