CVE-2018-0460

A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read any file on an affected system. The vulnerability is due to insufficient authorization and parameter validation checks. An attacker could exploit this vulnerability by sending a malicious API request with the authentication credentials of a low-privileged user. A successful exploit could allow the attacker to read any file on the affected system.

• CWE-285
• CWE-863

• http://www.securityfocus.com/bid/105299Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-nfvis-infodisVendor Advisory
• http://www.securityfocus.com/bid/105299Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-nfvis-infodisVendor Advisory

Published

Oct 5, 2018

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-0454A vulnerability in the web-based management interface of Cis…
• CVE-2018-0455A vulnerability in the Server Message Block Version 2 (SMBv2…
• CVE-2018-0456A vulnerability in the Simple Network Management Protocol (S…7.7
• CVE-2018-0457A vulnerability in the Cisco Webex Player for Webex Recordin…
• CVE-2018-0458A vulnerability in the web-based management interface of Cis…
• CVE-2018-0459A vulnerability in the web-based management interface of Cis…
• CVE-2018-0461A vulnerability in the Cisco IP Phone 8800 Series Software c…6.5
• CVE-2018-0462A vulnerability in the user management functionality of Cisc…
• CVE-2018-0463A vulnerability in the Cisco Network Plug and Play server co…
• CVE-2018-0464A vulnerability in Cisco Data Center Network Manager softwar…
• CVE-2018-0465A vulnerability in the web-based management interface of Cis…
• CVE-2018-0466A vulnerability in the Open Shortest Path First version 3 (O…