CVE-2017-12226

{"id": "CVE-2017-12226", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2017-09-29T01:34:48.593", "references": [{"url": "http://www.securityfocus.com/bid/101063", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1039456", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1039457", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-ngwc", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/101063", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1039456", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1039457", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-ngwc", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-264"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based Wireless Controller GUI of Cisco IOS XE Software for Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 4500E Supervisor Engine 8-E (Wireless) Switches, and Cisco New Generation Wireless Controllers (NGWC) 3850 could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incomplete input validation of HTTP requests by the affected GUI, if the GUI connection state or protocol changes. An attacker could exploit this vulnerability by authenticating to the Wireless Controller GUI as a Lobby Administrator user of an affected device and subsequently changing the state or protocol for their connection to the GUI. A successful exploit could allow the attacker to elevate their privilege level to administrator and gain full control of the affected device. This vulnerability affects the following Cisco products if they are running Cisco IOS XE Software Release 3.7.0E, 3.7.1E, 3.7.2E, 3.7.3E, 3.7.4E, or 3.7.5E: Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 4500E Supervisor Engine 8-E (Wireless) Switches, Cisco New Generation Wireless Controllers (NGWC) 3850. Cisco Bug IDs: CSCvd73746."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz gr\u00e1fica de usuario (GUI) web de los controladores de redes inal\u00e1mbricas de Cisco IOS XE para los controladores Wireless LAN de Cisco 5760, los switches de Cisco Catalyst 4500E Supervisor Engine 8-E (Wireless) y Cisco New Generation Wireless Controllers (NGWC) 3850 podr\u00eda permitir que un atacante remoto autenticado eleve sus privilegios en el dispositivo afectado. La vulnerabilidad se debe a una validaci\u00f3n de entrada incompleta de las peticiones HTTP de la GUI afectada si el estado de conexi\u00f3n a la GUI o el protocolo cambia. Un atacante podr\u00eda explotar esta vulnerabilidad autentic\u00e1ndose en la Wireless Controller GUI como un usuario Lobby Administrator de un dispositivo afectado y despu\u00e9s cambiando el estado o protocolo para su conexi\u00f3n con la GUI. Un exploit exitoso podr\u00eda permitir que el atacante eleve el nivel de privilegios a administrador y obtenga el control total del dispositivo afectado. La vulnerabilidad afecta a los siguientes productos de Cisco si ejecutan las distribuciones 3.7.0E, 3.7.1E, 3.7.2E, 3.7.3E, 3.7.4E o 3.7.5E del software de Cisco IOS XE: Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 4500E Supervisor Engine 8-E (Wireless) Switches, Cisco New Generation Wireless Controllers (NGWC) 3850. Cisco Bug IDs: CSCvd73746."}], "lastModified": "2024-11-21T03:09:04.510", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xe:3.7.0e:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A56AE607-0AD0-487A-A266-C15EAF40F2CB"}, {"criteria": "cpe:2.3:o:cisco:ios_xe:3.7.1e:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F8B8DBC-F273-4ADE-97F4-584DE23F1CEB"}, {"criteria": "cpe:2.3:o:cisco:ios_xe:3.7.2e:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "705971E9-7FB4-43EA-A1AE-C91865EADE16"}, {"criteria": "cpe:2.3:o:cisco:ios_xe:3.7.3e:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F481A851-D607-4CEF-87C5-147FFBC97D3A"}, {"criteria": "cpe:2.3:o:cisco:ios_xe:3.7.4e:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "355F4945-4FFA-469F-A799-815F371C637B"}, {"criteria": "cpe:2.3:o:cisco:ios_xe:3.7.5e:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1432B59F-5A66-4A5A-B3F7-E297700ED9C7"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}