CVE-2018-0420

CWE-22 — Path Traversal4 documents4 sources
Severity
6.5MEDIUM
EPSS
2.9%
top 13.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Cisco Wireless LAN Controller (wlc)Cisco Wireless LAN Controller Software
Timeline
PublishedOct 17
Latest updateMay 13

Description

A vulnerability in the web-based interface of Cisco Wireless LAN Controller Software could allow an authenticated, remote attacker to view sensitive information. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames and pathnames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view system files on the tar…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-5wmr-q26h-9p6x: A vulnerability in the web-based interface of Cisco Wireless LAN Controller Software could allow an authenticated, remote attacker to view sensitive i↗2022-05-13
▶
CVEList
Cisco Wireless LAN Controller Software Directory Traversal Vulnerability↗2018-10-17
▶

📋Vendor Advisories

1
Cisco
Cisco Wireless LAN Controller Software Directory Traversal Vulnerability↗2018-10-17
▶
CVE-2018-0420 (MEDIUM CVSS 6.5) | A vulnerability in the web-based in | cvebase.io