What is CVE-2018-0267?

CVE-2018-0267 is a medium-severity vulnerability in Cisco Unified Communications Manager, classified under Information Disclosure. CVSS score: 6.5/10. Published 2018-04-19.

How severe is CVE-2018-0267?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2018-0267 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Cisco Unified Communications Manager

CVE-2018-0267

A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, local attacker to view sensitive data that should be restricted. This could include LDAP credentials. The vulnerability is due to insufficient protection of database tables over the web interface. An attacker could exploit this vulnerability by browsing to a specific URL. An exploit could allow the attacker to view sensitive information that should have been restricted. Cisco Bug IDs: CSCvf22116.

Vulnerability class: Information Disclosure

Published 2018-04-19 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.004 (26.8th percentile), scored 2026-10-02.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 26.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: -0.000

Affected products

Cisco Unified Communications Manager — versions 12.0\(1.10000.10\), 10.5(2.10000.5), 10.5\(2.10000.5\)
Cisco Unified Communications Manager — versions Cisco Unified Communications Manager

Weakness classification (CWE)

Public proof-of-concept exploits

s-index/dora

References

www.securitytracker.com/id/1040719 (VDB Entry, Third Party Advisory, vdb-entry)
www.securityfocus.com/bid/103937 (VDB Entry, Third Party Advisory, vdb-entry)
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418… (Vendor Advisory)

Frequently asked questions

What is CVE-2018-0267?: CVE-2018-0267 is a medium-severity vulnerability in Cisco Unified Communications Manager, classified under Information Disclosure. CVSS score: 6.5/10. Published 2018-04-19.
How severe is CVE-2018-0267?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2018-0267 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.