CVE-2018-0420: Cisco Wireless LAN Controller Software Directory Traversal Vulnerability

Published Oct 17, 2018

Updated

A vulnerability in the web-based interface of Cisco Wireless LAN Controller Software could allow an authenticated, remote attacker to view sensitive information. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames and pathnames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view system files on the targeted device, which may contain sensitive information.

Affected Software

1 affected component

Cisco Wireless LAN Controller Software=8.2\(151.0\)

Event History

Oct 17, 2018

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2018-0420?

CVE-2018-0420 is a vulnerability in the web-based interface of Cisco Wireless LAN Controller Software that could allow an authenticated, remote attacker to view sensitive information.

How does CVE-2018-0420 affect Cisco Wireless LAN Controller Software?

CVE-2018-0420 affects Cisco Wireless LAN Controller Software version 8.2(151.0).

What is the severity of CVE-2018-0420?

The severity of CVE-2018-0420 is medium with a CVSS score of 6.5.

How can an attacker exploit CVE-2018-0420?

An attacker can exploit CVE-2018-0420 by sending specially crafted HTTP request parameters that describe filenames and pathnames.

How can I fix CVE-2018-0420?

To fix CVE-2018-0420, Cisco Wireless LAN Controller Software users should apply the necessary updates provided by Cisco.