Session fixation in Cisco FireSIGHT

1) Session fixation

EUVDB-ID: #VU409

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-6394

CWE-ID: CWE-384 - Session Fixation

Exploit availability: No

Description

The vulnerability allows a remote user to hijack the valid user's session.

The vulnerability exists due to web application uses previously generated session identifiers when the victim logs in to the application. A remote attacker can perform a session fixation attack and hijack target user's session.

Successful exploitation of this vulnerability may result in hijacking of valid user's browser session.

Mitigation

Cybersecurity Help is currently unaware of any official patch, which addresses this vulnerability.

Vulnerable software versions

Cisco FireSIGHT: 5.3.0 - 6.1

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160907-fsmc

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.