CVE-2018-0269

A vulnerability in the web framework of the Cisco Digital Network Architecture Center (DNA Center) could allow an unauthenticated, remote attacker to communicate with the Kong API server without restriction. The vulnerability is due to an overly permissive Cross Origin Resource Sharing (CORS) policy. An attacker could exploit this vulnerability by convincing a user to follow a malicious link. An exploit could allow the attacker to communicate with the API and exfiltrate sensitive information. Cisco Bug IDs: CSCvh99208.

• CWE-200
• CWE-863

• http://www.securityfocus.com/bid/103950Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-dna1Vendor Advisory
• http://www.securityfocus.com/bid/103950Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-dna1Vendor Advisory

Published

Apr 19, 2018

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-0263A vulnerability in Cisco Meeting Server (CMS) could allow an…7.4
• CVE-2018-0264A vulnerability in the Cisco WebEx Network Recording Player …
• CVE-2018-0265Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-0266A vulnerability in the web framework of Cisco Unified Commun…4.3
• CVE-2018-0267A vulnerability in the web framework of Cisco Unified Commun…6.5
• CVE-2018-0268A vulnerability in the container management subsystem of Cis…
• CVE-2018-0270A vulnerability in the web-based management interface of Cis…
• CVE-2018-0271A vulnerability in the API gateway of the Cisco Digital Netw…
• CVE-2018-0272A vulnerability in the Secure Sockets Layer (SSL) Engine of …
• CVE-2018-0273A vulnerability in the IPsec Manager of Cisco StarOS for Cis…
• CVE-2018-0274A vulnerability in the CLI parser of Cisco Network Services …8.8
• CVE-2018-0275A vulnerability in the support tunnel feature of Cisco Ident…