CVE-2018-0420: A vulnerability in the web-based interface of Cisco Wireless LAN Controller Software could allow an authenticated, remote attacker to view sensitive…

medium6.5CVSS 3.1

AVNACLPRLUINSUCHINAN

A vulnerability in the web-based interface of Cisco Wireless LAN Controller Software could allow an authenticated, remote attacker to view sensitive information. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames and pathnames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view system files on the targeted device, which may contain sensitive information.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_wireless_lan_controller	—	—
cisco	wireless_lan_controller	—	—
cisco	wireless_lan_controller_software	—	—