Session hijacking in Cisco Prime LAN Management Solution - CVE-2017-12225
Published: September 7, 2017
Vulnerability identifier: #VU8150
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-12225
CWE-ID: CWE-384
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to perform session fixation attack on the target system.
The weakness exists in the web functionality of the Cisco Prime LAN Management Solution due to the reuse of a preauthentication session token as part of the postauthentication session. A remote attacker can obtain the presession token ID and hijack an existing user's session.
The weakness exists in the web functionality of the Cisco Prime LAN Management Solution due to the reuse of a preauthentication session token as part of the postauthentication session. A remote attacker can obtain the presession token ID and hijack an existing user's session.
Affected software
Cisco Prime LAN Management Solution
How to mitigate CVE-2017-12225
Install update from vendor's website.