CVE-2017-12225: Medium severity cisco Prime LAN Management Solution vulnerability
A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session, aka a Session Fixation Vulnerability. The vulnerability is due to the reuse of a preauthentication session token as part of the postauthentication session. An attacker could exploit this vulnerability by obtaining the presession token ID. An exploit could allow an attacker to hijack an existing user's session. Known Affected Releases 4.2(5). Cisco Bug IDs: CSCvf58392.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12225?
CVE-2017-12225 has a severity rating of medium due to its potential for session hijacking.
How do I fix CVE-2017-12225?
To fix CVE-2017-12225, you should upgrade to the latest version of Cisco Prime LAN Management Solution where the vulnerability has been addressed.
Who is affected by CVE-2017-12225?
CVE-2017-12225 affects users of Cisco Prime LAN Management Solution version 4.2(5) who are authenticated remote attackers.
What type of attack is enabled by CVE-2017-12225?
CVE-2017-12225 enables an authenticated remote attacker to perform session fixation attacks.
Can CVE-2017-12225 be exploited without authentication?
No, CVE-2017-12225 requires that the attacker be an authenticated user to exploit the vulnerability.