PT-2017-12416 · Cisco · Cisco Prime Lan Management Solution

Publicado 2017-09-07 · Atualizado 2019-10-09 · CVE-2017-12225

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime LAN Management Solution version 4.2(5)

Description A session fixation issue in the web functionality of the Cisco Prime LAN Management Solution allows an authenticated, remote attacker to hijack another user's administrative session. This is due to the reuse of a preauthentication session token as part of the postauthentication session. An attacker could exploit this by obtaining the presession token ID, potentially allowing them to hijack an existing user's session.

Recommendations For version 4.2(5), consider restricting access to the web functionality of the Cisco Prime LAN Management Solution until a fix is available, and avoid reusing preauthentication session tokens to minimize the risk of session hijacking. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Session Fixation

Enumeração de Fraquezas

CWE-287

CWE-384

Identificadores relacionados

CVE-2017-12225

Produtos afetados

Cisco Prime Lan Management Solution

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-12225 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-prime-lms · Aviso do Fabricante
• https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf58392 · Aviso do Fabricante
• http://securitytracker.com/id/1039285 · Nota
• https://osv.dev/vulnerability/CVE-2017-12225 · Aviso do Fabricante