{"containers": {"cna": {"affected": [{"product": "Cisco Meeting Server unknown", "vendor": "n/a", "versions": [{"status": "affected", "version": "Cisco Meeting Server unknown"}]}], "datePublic": "2018-06-21T00:00:00", "descriptions": [{"lang": "en", "value": "A vulnerability in the session identification management functionality of the web-based management interface for Cisco Meeting Server could allow an unauthenticated, local attacker to hijack a valid user session identifier, aka Session Fixation. The vulnerability exists because the affected application does not assign a new session identifier to a user session when a user authenticates to the application. An attacker could exploit this vulnerability by using a hijacked session identifier to connect to the application through the web-based management interface. A successful exploit could allow the attacker to hijack an authenticated user's browser session. Cisco Bug IDs: CSCvi23787."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-384", "description": "CWE-384", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2018-07-03T09:57:01", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco"}, "references": [{"name": "104583", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/104583"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-cms-sf"}, {"name": "1041174", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1041174"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@cisco.com", "ID": "CVE-2018-0359", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Cisco Meeting Server unknown", "version": {"version_data": [{"version_value": "Cisco Meeting Server unknown"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability in the session identification management functionality of the web-based management interface for Cisco Meeting Server could allow an unauthenticated, local attacker to hijack a valid user session identifier, aka Session Fixation. The vulnerability exists because the affected application does not assign a new session identifier to a user session when a user authenticates to the application. An attacker could exploit this vulnerability by using a hijacked session identifier to connect to the application through the web-based management interface. A successful exploit could allow the attacker to hijack an authenticated user's browser session. Cisco Bug IDs: CSCvi23787."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-384"}]}]}, "references": {"reference_data": [{"name": "104583", "refsource": "BID", "url": "http://www.securityfocus.com/bid/104583"}, {"name": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-cms-sf", "refsource": "CONFIRM", "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-cms-sf"}, {"name": "1041174", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1041174"}]}}}}, "cveMetadata": {"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2018-0359", "datePublished": "2018-06-21T11:00:00", "dateReserved": "2017-11-27T00:00:00", "dateUpdated": "2018-07-03T09:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:meeting_server:2.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "7D90BAA6-4623-4AFB-B0D0-14CD2CDB6968", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the session identification management functionality of the web-based management interface for Cisco Meeting Server could allow an unauthenticated, local attacker to hijack a valid user session identifier, aka Session Fixation. The vulnerability exists because the affected application does not assign a new session identifier to a user session when a user authenticates to the application. An attacker could exploit this vulnerability by using a hijacked session identifier to connect to the application through the web-based management interface. A successful exploit could allow the attacker to hijack an authenticated user's browser session. Cisco Bug IDs: CSCvi23787."}, {"lang": "es", "value": "Una vulnerabilidad en la funcionalidad de identificaci\u00f3n de sesi\u00f3n de la interfaz web de gesti\u00f3n de Cisco Meeting Server podr\u00eda permitir que un atacante local no autenticado secuestre un identificador de sesi\u00f3n de un usuario v\u00e1lido. Esto tambi\u00e9n se conoce como fijaci\u00f3n de sesi\u00f3n. La vulnerabilidad existe debido a que la aplicaci\u00f3n afectada no asigna un nuevo identificador de sesi\u00f3n en una sesi\u00f3n de usuario cuando un usuario se autentica en la aplicaci\u00f3n. Un atacante podr\u00eda explotar esta vulnerabilidad mediante el uso de un identificador de sesi\u00f3n secuestrado para conectarse a la aplicaci\u00f3n a trav\u00e9s de la interfaz web de gesti\u00f3n. Si se explota esta vulnerabilidad, un atacante podr\u00eda secuestrar la sesi\u00f3n de navegaci\u00f3n de un usuario autenticado. Cisco Bug IDs: CSCvi23787."}], "id": "CVE-2018-0359", "lastModified": "2019-10-09T23:31:52.207", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-06-21T11:29:00.930", "references": [{"source": "ykramarz@cisco.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/104583"}, {"source": "ykramarz@cisco.com", "tags": ["VDB Entry", "Third Party Advisory"], "url": "http://www.securitytracker.com/id/1041174"}, {"source": "ykramarz@cisco.com", "tags": ["Vendor Advisory"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-cms-sf"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-384"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-384"}], "source": "ykramarz@cisco.com", "type": "Secondary"}]}

{}