CVE-2018-0382
Cisco Wireless LAN Controller Software Session Hijacking Vulnerability
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Cisco Wireless LAN Controller Software Session Hijacking Vulnerability
| Assigner | cisco |
| Reserved | 2017-11-27 |
| Published | 2019-04-17 |
| Updated | 2024-09-16 |
A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected software does not properly clear previously assigned session identifiers for a user session when a user authenticates to the web-based interface. An attacker could exploit this vulnerability by using an existing session identifier to connect to the software through the web-based interface. Successful exploitation could allow the attacker to hijack an authenticated user's browser session on the system. Versions 8.1 and 8.5 are affected.
| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-wlan-hijack (20190417 Cisco Wireless LAN Controller Software Session Hijacking Vulnerability)
http://www.securityfocus.com/bid/108005 (108005)
