Vulnerability record · CVE-2018-0107 · published 18 January 2018

CVE-2018-0107: Cisco prime service catalog cross-site request forgery vulnerability

Cisco · Prime Service Catalog

A vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery (CSRF) protection. An attacker could exploit this vulnerability by tricking the user of a web application into executing an adverse action. Cisco Bug IDs: CSCvg30313.

8.8 CVSS 3.0 High EPSS 0.83% · top 41.9% CWE-352 · Cross-site request forgery

8.8CVSS 3.0 base score, v2 6.8

0.83%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Prime Service Catalog Cisco

References

Link	Tags
http://www.securityfocus.com/bid/102719	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040244	Third Party AdvisoryVDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-psc	Vendor Advisory
http://www.securityfocus.com/bid/102719	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040244	Third Party AdvisoryVDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-psc	Vendor Advisory

Track CVE-2018-0107 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2021-44228Apache Log4j2 JNDI lookup remote code executionApache Log4j2 versions 2.0-beta9 through 2.15.0 (excluding 2.12.2, 2.12.3, and 2.3.1) do not protect against attacker-controlled LDAP and other JNDI …KEVEPSS 100%analysed10 Dec 2021 8.8CVE-2019-1874Cisco prime service catalog cross-site request forgery vulnerabilityA vulnerability in the web-based management interface of Cisco Prime Service Catalog Software could allow an unauthenticated, remote attacker to cond…EPSS 0.80%20 Jun 2019 7.5CVE-2015-0581Cisco prime service catalog vulnerabilityThe XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU…EPSS 2.4%28 Jan 2015 6.5CVE-2022-20680Cisco prime service catalog information exposure vulnerabilityA vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to access sensitiv…EPSS 1.1%10 Feb 2022 6.5CVE-2018-0285Cisco prime service catalog uncontrolled resource consumption vulnerabilityA vulnerability in service logging for Cisco Prime Service Catalog could allow an authenticated, remote attacker to deny service to the user interfac…EPSS 2.6%2 May 2018 6.5CVE-2017-12364Cisco prime service catalog sql injection vulnerabilityA SQL Injection vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unauthor…EPSS 1.3%30 Nov 2017 6.5CVE-2015-6395Cisco prime service catalog permissions and access controls vulnerabilityCisco Prime Service Catalog 10.0, 10.0(R2), 10.1, and 11.0 does not properly restrict access to web pages, which allows remote attackers to modify th…EPSS 1.5%12 Dec 2015 6.5CVE-2015-6350Cisco prime service catalog sql injection vulnerabilitySQL injection vulnerability in the web framework in Cisco Prime Service Catalog 11.0 allows remote authenticated users to execute arbitrary SQL comma…EPSS 1.4%30 Oct 2015

Source: NIST National Vulnerability Database (record CVE-2018-0107), CISA KEV, FIRST EPSS (scores of 2026-11-12). This page is refreshed as NVD updates the record.