Cisco Prime LAN Management Solution 4.2(5) Web session fixiation

Summaryinfo

A vulnerability was found in Cisco Prime LAN Management Solution 4.2(5). It has been classified as critical. The impacted element is an unknown function of the component Web. The manipulation leads to session fixiation. This vulnerability is listed as CVE-2017-12225. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Cisco Prime LAN Management Solution 4.2(5) and classified as critical. This issue affects an unknown code block of the component Web. The manipulation with an unknown input leads to a session fixiation vulnerability. Using CWE to declare the problem leads to CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session, aka a Session Fixation Vulnerability. The vulnerability is due to the reuse of a preauthentication session token as part of the postauthentication session. An attacker could exploit this vulnerability by obtaining the presession token ID. An exploit could allow an attacker to hijack an existing user's session. Known Affected Releases 4.2(5). Cisco Bug IDs: CSCvf58392.

The bug was discovered 09/06/2017. The weakness was presented 09/07/2017 (Website). It is possible to read the advisory at quickview.cloudapps.cisco.com. The identification of this vulnerability is CVE-2017-12225 since 08/03/2017. The attack may be initiated remotely. The requirement for exploitation is a simple authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 103113 (Cisco Prime LAN Management Solution Session Fixation Vulnerability), which helps to determine the existence of the flaw in a target environment. It is assigned to the family CISCO and running in the context r.

Upgrading eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (103113). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Cisco

Name

• Prime LAN Management Solution

Version

• 4.2(5)

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion