PT-2017-12416 · Cisco · Cisco Prime Lan Management Solution

Published 2017-09-07 · Updated 2019-10-09 · CVE-2017-12225

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime LAN Management Solution version 4.2(5)

Description A session fixation issue in the web functionality of the Cisco Prime LAN Management Solution allows an authenticated, remote attacker to hijack another user's administrative session. This is due to the reuse of a preauthentication session token as part of the postauthentication session. An attacker could exploit this by obtaining the presession token ID, potentially allowing them to hijack an existing user's session.

Recommendations For version 4.2(5), consider restricting access to the web functionality of the Cisco Prime LAN Management Solution until a fix is available, and avoid reusing preauthentication session tokens to minimize the risk of session hijacking. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Session Fixation

Weakness Enumeration

CWE-287

CWE-384

Related Identifiers

CVE-2017-12225

Affected Products

Cisco Prime Lan Management Solution

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-12225 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-prime-lms · Vendor Advisory
• https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf58392 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12225 · Vendor Advisory
• http://securitytracker.com/id/1039285 · Note