CVE-2018-0382: Cisco Wireless LAN Controller Software Session Hijacking Vulnerability
First published: Wed Apr 17 2019(Updated: )
A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected software does not properly clear previously assigned session identifiers for a user session when a user authenticates to the web-based interface. An attacker could exploit this vulnerability by using an existing session identifier to connect to the software through the web-based interface. Successful exploitation could allow the attacker to hijack an authenticated user's browser session on the system. Versions 8.1 and 8.5 are affected.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Wireless LAN Controller Software | =8.1\(111.0\) | |
| Cisco Wireless LAN Controller Software | =8.5\(120.0\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-0382.
What is the severity level of CVE-2018-0382?
The severity level of CVE-2018-0382 is high.
What is the affected software for CVE-2018-0382?
The affected software for CVE-2018-0382 is Cisco Wireless LAN Controller Software version 8.1 (111.0) and version 8.5 (120.0).
How can an attacker exploit CVE-2018-0382?
An unauthenticated, remote attacker can exploit CVE-2018-0382 to hijack a valid user session on an affected system.
Are there any references for CVE-2018-0382?
Yes, you can find references for CVE-2018-0382 at the following links: [securityfocus.com](http://www.securityfocus.com/bid/108005) and [tools.cisco.com](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-wlan-hijack).
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/description
- agent/event
- agent/tags
- vendor/cisco
- canonical/cisco wireless lan controller software
- version/cisco wireless lan controller software/8.1\(111.0\)
- version/cisco wireless lan controller software/8.5\(120.0\)