Information disclosure in Cisco 5500 Series Wireless Controllers - CVE-2018-0245
Published: May 7, 2018
Vulnerability identifier: #VU12376
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-0245
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Cisco Systems, Inc
Affected software:
Cisco 5500 Series Wireless Controllers
Cisco 5500 Series Wireless Controllers
Detailed vulnerability description
The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information.
The weakness exists in the REST API due to incomplete input and validation checking mechanisms in the REST API URL request. A remote attacker can send a specially crafted URL to the REST API and gain access to potentially sensitive information.
The weakness exists in the REST API due to incomplete input and validation checking mechanisms in the REST API URL request. A remote attacker can send a specially crafted URL to the REST API and gain access to potentially sensitive information.
How to mitigate CVE-2018-0245
Update to versions 8.8(1.4), 8.7(102.0), 8.7(1.124), 8.6(101.0), 8.6(1.181), 8.5(110.0), 8.5(107.110), 8.3(140.0) or 8.3(134.81).