CVE-2018-0229 — Session Fixation in Cisco Adaptive Security Appliance Software

CWE-384 — Session Fixation4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
1.0%
top 22.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Adaptive Security Appliance SoftwareCisco Anyconnect Secure Mobility Client
Timeline
PublishedApr 19
Latest updateMay 13

Description

A vulnerability in the implementation of Security Assertion Markup Language (SAML) Single Sign-On (SSO) authentication for Cisco AnyConnect Secure Mobility Client for Desktop Platforms, Cisco Adaptive Security Appliance (ASA) Software, and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to establish an authenticated AnyConnect session through an affected device running ASA or FTD Software. The authentication would need to be done by an unsuspecting t…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-jp4c-v6vq-9m4m: A vulnerability in the implementation of Security Assertion Markup Language (SAML) Single Sign-On (SSO) authentication for Cisco AnyConnect Secure Mob↗2022-05-13
▶
CVEList
CVE-2018-0229: A vulnerability in the implementation of Security Assertion Markup Language (SAML) Single Sign-On (SSO) authentication for Cisco AnyConnect Secure Mob↗2018-04-19
▶

📋Vendor Advisories

1
Cisco
Cisco ASA Software, FTD Software, and AnyConnect Secure Mobility Client SAML Authentication Session Fixation Vulnerability↗2018-04-18
▶
CVE-2018-0229 — Session Fixation in Cisco | cvebase