CVE-2018-0359

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A vulnerability in the session identification management functionality of the web-based management interface for Cisco Meeting Server could allow an unauthenticated, local attacker to hijack a valid user session identifier, aka Session Fixation. The vulnerability exists because the affected application does not assign a new session identifier to a user session when a user authenticates to the application. An attacker could exploit this vulnerability by using a hijacked session identifier to connect to the application through the web-based management interface. A successful exploit could allow the attacker to hijack an authenticated user's browser session. Cisco Bug IDs: CSCvi23787.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
n/a	Cisco Meeting Server unknown	Cisco Meeting Server unknown

References

http://www.securityfocus.com/bid/104583Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041174Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-cms-sfVendor Advisory
http://www.securityfocus.com/bid/104583Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041174Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-cms-sfVendor Advisory

Timeline

Published: Jun 21, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-03605.5ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. This is in parseh CVE-2018-03613.3ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file.CVE-2018-03624.3A vulnerability in BIOS authentication management of Cisco 5000 Series Enterprise Network Compute System and Cisco Unified Computing (UCS) E CVE-2018-03638.8A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (formerly CUPS) could al CVE-2018-03648.8A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote CVE-2018-03658.8A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated, remote attacker t CVE-2018-03666.1A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker CVE-2018-03675.4A vulnerability in the web-based management interface of the Cisco Registered Envelope Service could allow an authenticated, remote attacker CVE-2018-03687.8A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, local attacker to access sensitive informat CVE-2018-03698.6A vulnerability in the reassembly logic for fragmented IPv4 packets of Cisco StarOS running on virtual platforms could allow an unauthentica CVE-2018-03707.5A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause one of t CVE-2018-03716.5A vulnerability in the Web Admin Interface of Cisco Meeting Server could allow an authenticated, remote attacker to cause a denial of servic