Session Fixation Vulnerability in Cisco Meeting Server Management Interface

CVE-2018-0359

Summary

A vulnerability exists in the session identification management functionality of Cisco Meeting Server's web-based management interface. This design flaw allows an unauthenticated local attacker to hijack valid user session identifiers, potentially leading to unauthorized access. The application fails to assign a new session identifier during user authentication, leaving sessions vulnerable. An attacker can exploit this flaw by using a hijacked session identifier, allowing them to connect to the application and hijack an authenticated user's browser session, thereby gaining unauthorized access to sensitive data and control.

References