CVE-2017-6617

CWE-287 — Improper Authentication4 documents4 sources
Severity
5.4MEDIUM
EPSS
0.3%
top 47.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Integrated Management Controller Supervisor
Timeline
PublishedApr 20
Latest updateMay 13

Description

A vulnerability in the session identification management functionality of the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected software does not assign a new session identifier to a user session when a user authenticates to the web-based GUI. An attacker could exploit this vulnerability by using a hijacked session identifier to c…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages2 packages

▶CVEListV5cisco_integrated_management_controllerCisco Integrated Management Controller

🔴Vulnerability Details

2
GHSA
GHSA-4wm8-hvm8-ph45: A vulnerability in the session identification management functionality of the web-based GUI of Cisco Integrated Management Controller (IMC) 3↗2022-05-13
▶
CVEList
CVE-2017-6617: A vulnerability in the session identification management functionality of the web-based GUI of Cisco Integrated Management Controller (IMC) 3↗2017-04-20
▶

📋Vendor Advisories

1
Cisco
Cisco Integrated Management Controller User Session Hijacking Vulnerability↗2017-04-19
▶
CVE-2017-6617 (MEDIUM CVSS 5.4) | A vulnerability in the session iden | cvebase.io