====================================================================


                             CERT-Renater

                 Note d'Information No. 2018/VULN251
_____________________________________________________________________

DATE                : 02/08/2018

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Cisco Prime Collaboration
                                   Provisioning.

=====================================================================
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-pcp-dos
_____________________________________________________________________

Cisco Security Advisory: Cisco Prime Collaboration Provisioning
Unauthorized Password Change Denial of Service Vulnerability

Advisory ID: cisco-sa-20180801-pcp-dos

Revision: 1.0

For Public Release: 2018 August 1 16:00 GMT

Last Updated: 2018 August 1 16:00 GMT

CVE ID(s): CVE-2018-0391

CVSS Score v(3): 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

+---------------------------------------------------------------------

Summary

=======

A vulnerability in the password change function of Cisco Prime
Collaboration Provisioning could allow an authenticated, remote attacker
to cause the system to become inoperable.

The vulnerability is due to insufficient validation of a password change
request. An attacker could exploit this vulnerability by changing a
specific administrator account password. A successful exploit could
allow the attacker to cause the affected device to become inoperable,
resulting in a denial of service (DoS) condition.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-pcp-dos
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-pcp-dos"]


=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================