Lucene search

CiscoCVELIST:CVE-2018-0382

HistoryApr 17, 2019 - 9:35 p.m.

CVE-2018-0382 Cisco Wireless LAN Controller Software Session Hijacking Vulnerability

2019-04-1721:35:14

CWE-287

cisco

www.cve.org

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

51.1%

JSON

A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected software does not properly clear previously assigned session identifiers for a user session when a user authenticates to the web-based interface. An attacker could exploit this vulnerability by using an existing session identifier to connect to the software through the web-based interface. Successful exploitation could allow the attacker to hijack an authenticated user’s browser session on the system. Versions 8.1 and 8.5 are affected.

CNA Affected

[
  {
    "product": "Cisco Wireless LAN Controller (WLC)",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "8.5(144.5)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/108005

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-wlan-hijack

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

51.1%

JSON

Related for CVELIST:CVE-2018-0382