cisco-sa-20190417-wlan-hijack: Cisco Wireless LAN Controller Software Session Hijacking Vulnerability
First published: Wed Apr 17 2019(Updated: )
A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected software does not properly clear previously assigned session identifiers for a user session when a user authenticates to the web-based interface. An attacker could exploit this vulnerability by using an existing session identifier to connect to the software through the web-based interface. Successful exploitation could allow the attacker to hijack an authenticated user's browser session on the system. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-wlan-hijack
Credit: This vulnerability was found during the resolution a Cisco TAC support case
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Wireless LAN Controllers |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20190417-wlan-hijack?
The severity of cisco-sa-20190417-wlan-hijack is categorized as high due to the potential for session hijacking.
How do I fix cisco-sa-20190417-wlan-hijack?
To fix cisco-sa-20190417-wlan-hijack, you should upgrade your Cisco Wireless LAN Controller Software to the latest version provided by Cisco.
Who is affected by cisco-sa-20190417-wlan-hijack?
Organizations utilizing affected versions of the Cisco Wireless LAN Controller Software are at risk of the cisco-sa-20190417-wlan-hijack vulnerability.
What are the potential impacts of cisco-sa-20190417-wlan-hijack?
The potential impacts of cisco-sa-20190417-wlan-hijack include unauthorized access to user sessions, leading to data breaches or unauthorized actions.
Is cisco-sa-20190417-wlan-hijack remotely exploitable?
Yes, cisco-sa-20190417-wlan-hijack is remotely exploitable by unauthenticated attackers.
- agent/type
- agent/event
- agent/last-modified-date
- collector/cisco-advisory
- source/Cisco
- agent/weakness
- agent/title
- agent/author
- agent/severity
- agent/references
- agent/description
- agent/first-publish-date
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco wireless lan controllers