Information disclosure in Cisco 5500 Series Wireless Controllers - CVE-2018-0245
Published: May 7, 2018
Vulnerability identifier: #VU12376
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-0245
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information.
The weakness exists in the REST API due to incomplete input and validation checking mechanisms in the REST API URL request. A remote attacker can send a specially crafted URL to the REST API and gain access to potentially sensitive information.
The weakness exists in the REST API due to incomplete input and validation checking mechanisms in the REST API URL request. A remote attacker can send a specially crafted URL to the REST API and gain access to potentially sensitive information.
Affected software
Cisco 5500 Series Wireless Controllers
How to mitigate CVE-2018-0245
Update to versions 8.8(1.4), 8.7(102.0), 8.7(1.124), 8.6(101.0), 8.6(1.181), 8.5(110.0), 8.5(107.110), 8.3(140.0) or 8.3(134.81).