====================================================================


                             CERT-Renater

                 Note d'Information No. 2018/VULN275
_____________________________________________________________________

DATE                : 06/09/2018

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Cisco Data Center Network Manager
                            versions prior to 11.0(1).

=====================================================================
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-cdcnm-escalation
_____________________________________________________________________

Cisco Security Advisory: Cisco Data Center Network Manager Privilege
Escalation to Underlying Operating System Vulnerability

Advisory ID: cisco-sa-20180905-cdcnm-escalation

Revision: 1.0

For Public Release: 2018 September 5 16:00 GMT

Last Updated: 2018 September 5 16:00 GMT

CVE ID(s): CVE-2018-0440

CVSS Score v(3): 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

+---------------------------------------------------------------------

Summary

=======

A vulnerability in the web interface of Cisco Data Center Network
Manager could allow an authenticated application administrator to
execute commands on the underlying operating system with root-level
privileges.

The vulnerability is due to incomplete input validation of user input
within an HTTP request. An attacker could exploit this vulnerability by
authenticating to the application and then  sending a crafted HTTP
request to the targeted application. A successful exploit could allow
the authenticated attacker to issue commands on the underlying operating
system as the root user.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-cdcnm-escalation
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-cdcnm-escalation"]

=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================