CVE-2018-0393 json
A Read-Only User Effect Change vulnerability in the Policy Builder interface of Cisco Policy Suite could allow an authenticated, remote att…
published 2018-07-18 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-1216
- cvss
- 6.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 60%
- public exploits
- 0
- none known
Summary
A Read-Only User Effect Change vulnerability in the Policy Builder interface of Cisco Policy Suite could allow an authenticated, remote attacker to make policy changes in the Policy Builder interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by accessing the Policy Builder interface and modifying an HTTP request. A successful exploit could allow the attacker to make changes to existing policies. Cisco Bug IDs: CSCvi35007.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction
0.92% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N |
Affected products
- n/a Cisco Policy Suite unknown
Classification
- Weakness
-
- CWE-285 Improper Authorization
References
-
tools.cisco.com
/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-policy-suite-change
vendor-advisory
-
securityfocus.com
/bid/104867
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2018-0393
- NVD CVE-2018-0393
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.