Resource exhaustion in Cisco Unity Connection
CVE-2018-15396
A vulnerability in the Bulk Administration Tool (BAT) for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software does not restrict the maximum size of certain files that can be written to disk. An attacker who has valid administrator credentials for an affected system could exploit this vulnerability by sending a crafted, remote connection request to an affected system. A successful exploit could allow the attacker to write a file that consumes most of the available disk space on the system, causing application functions to operate abnormally and leading to a DoS condition.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.018 (78.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 78th percentile — 78.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.018 · newest: 0.018 · change: 0.000
Affected products
- Cisco Unity Connection
- Cisco Unity Connection — versions 12.5
Weakness classification (CWE)
References
- www.securitytracker.com/id/1041782 (VDB Entry, Third Party Advisory, vdb-entry)
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003… (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-15396?
- CVE-2018-15396 is a medium-severity vulnerability in Cisco Unity Connection, classified under CWE-399. CVSS score: 6.8/10. Published 2018-10-05.
- How severe is CVE-2018-15396?
- Medium severity. CVSS v3 base score is 6.8 out of 10.