Vulnerability Description
A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session, aka a Session Fixation Vulnerability. The vulnerability is due to the reuse of a preauthentication session token as part of the postauthentication session. An attacker could exploit this vulnerability by obtaining the presession token ID. An exploit could allow an attacker to hijack an existing user's session. Known Affected Releases 4.2(5). Cisco Bug IDs: CSCvf58392.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Prime Lan Management Solution | 4.2\(5\) |
Related Weaknesses (CWE)
References
- http://www.securitytracker.com/id/1039285Third Party AdvisoryVDB Entry
- https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf58392Vendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory
- http://www.securitytracker.com/id/1039285Third Party AdvisoryVDB Entry
- https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf58392Vendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory
FAQ
What is CVE-2017-12225?
CVE-2017-12225 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session, aka a Session Fixatio...
How severe is CVE-2017-12225?
CVE-2017-12225 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-12225?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Prime Lan Management Solution.