CVE-2018-0245: Infoleak

Published May 2, 2018

Updated

A vulnerability in the REST API of Cisco 5500 and 8500 Series Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to view system information that under normal circumstances should be prohibited. The vulnerability is due to incomplete input and validation checking mechanisms in the REST API URL request. An attacker could exploit this vulnerability by sending a malicious URL to the REST API. If successful, an exploit could allow the attacker to view sensitive system information. Cisco Bug IDs: CSCvg89442.

Affected Software

2 affected components

Cisco Wireless LAN Controller Software=8.3\(133.0\)

Cisco Wireless LAN Controller Software=8.5\(105.0\)

Event History

May 2, 2018

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability description for CVE-2018-0245?

The vulnerability allows an unauthenticated, remote attacker to view system information that should be prohibited.

What is the affected software for CVE-2018-0245?

Cisco 5500 and 8500 Series Wireless LAN Controller (WLC) Software version 8.3(133.0) and 8.5(105.0) are affected.

What is the severity rating for CVE-2018-0245?

The severity rating is medium with a CVSS score of 5.3.

How can an attacker exploit CVE-2018-0245?

An attacker can exploit the vulnerability by sending a crafted API request to the affected system.

Is there a fix available for CVE-2018-0245?

Yes, Cisco has released a security advisory with recommended patches to address the vulnerability.