CVE-2017-6617

{"id": "CVE-2017-6617", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2017-04-20T22:59:00.823", "references": [{"url": "http://www.securityfocus.com/bid/97929", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-cimc2", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the session identification management functionality of the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected software does not assign a new session identifier to a user session when a user authenticates to the web-based GUI. An attacker could exploit this vulnerability by using a hijacked session identifier to connect to the software through the web-based GUI. A successful exploit could allow the attacker to hijack an authenticated user's browser session on the affected system. Cisco Bug IDs: CSCvd14583."}, {"lang": "es", "value": "Una vulnerabilidad en la funcionalidad de administraci\u00f3n de identificaci\u00f3n de sesi\u00f3n de la GUI basada en web de Cisco Integrated Management Controller (IMC) 3.0 (1c) podr\u00eda permitir a un atacante remoto no autenticado secuestrar una sesi\u00f3n de usuario v\u00e1lida en un sistema afectado. La vulnerabilidad existe porque el software afectado no asigna un nuevo identificador de sesi\u00f3n a una sesi\u00f3n de usuario cuando un usuario se autentica en la GUI basada en web. Un atacante podr\u00eda explotar esta vulnerabilidad usando un identificador de sesi\u00f3n secuestrado para conectarse al software a trav\u00e9s de la GUI basada en web. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante secuestrar la sesi\u00f3n del navegador de un usuario autenticado en el sistema afectado. Cisco Bug IDs: CSCvd14583."}], "lastModified": "2019-10-09T23:28:51.077", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:integrated_management_controller_supervisor:3.0\\(1c\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "674BE7E5-FC1C-4083-B4D3-8C816239D0CB"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}