CVE-2018-0247

{"id": "CVE-2018-0247", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.3, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 4.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2018-05-02T22:29:00.513", "references": [{"url": "http://www.securityfocus.com/bid/104087", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1040814", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1040815", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-aironet-auth", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in Web Authentication (WebAuth) clients for the Cisco Wireless LAN Controller (WLC) and Aironet Access Points running Cisco IOS Software could allow an unauthenticated, adjacent attacker to bypass authentication and pass traffic. The vulnerability is due to incorrect implementation of authentication for WebAuth clients in a specific configuration. An attacker could exploit this vulnerability by sending traffic to local network resources without having gone through authentication. A successful exploit could allow the attacker to bypass authentication and pass traffic. This affects Cisco Aironet Access Points running Cisco IOS Software and Cisco Wireless LAN Controller (WLC) releases prior to 8.5.110.0 for the following specific WLC configuration only: (1) The Access Point (AP) is configured in FlexConnect Mode with NAT. (2) The WLAN is configured for central switching, meaning the client is being assigned a unique IP address. (3) The AP is configured with a Split Tunnel access control list (ACL) for access to local network resources, meaning the AP is doing the NAT on the connection. (4) The client is using WebAuth. This vulnerability does not apply to .1x clients in the same configuration. Cisco Bug IDs: CSCvc79502, CSCvf71789."}, {"lang": "es", "value": "Una vulnerabilidad en los clientes Web Authentication (WebAuth) para Cisco Wireless LAN Controller (WLC) y Aironet Access Points que ejecutan el software Cisco IOS podr\u00eda permitir que un atacante adyacente sin autenticar omita la autenticaci\u00f3n y pase tr\u00e1fico. La vulnerabilidad se debe a la implementaci\u00f3n incorrecta de la autenticaci\u00f3n para los clientes WebAuth en una configuraci\u00f3n espec\u00edfica. Un atacante podr\u00eda explotar esta vulnerabilidad enviando tr\u00e1fico a recursos en la red local sin tener que pasar por la autenticaci\u00f3n. Su explotaci\u00f3n con \u00e9xito podr\u00eda permitir que el atacante omita la autenticaci\u00f3n y pase tr\u00e1fico. Esto afecta a Cisco Aironet Access Points que ejecutan el software Cisco IOS y Cisco Wireless LAN Controller (WLC) en lanzamientos anteriores a la versi\u00f3n 8.5.110.0 solo para la siguiente configuraci\u00f3n espec\u00edfica de WLC: (1) El punto de acceso (AP) est\u00e1 configurado en modo FlexConnect con NAT. (2) El WLAN est\u00e1 configurado para switching central, lo que significa que al cliente se le asigna una direcci\u00f3n IP \u00fanica. (3) El AP est\u00e1 configurado con una lista de control de acceso (ACL) de Split Tunnel para acceder a recursos de la red local, lo que significa que el AP est\u00e1 realizando NAT en la conexi\u00f3n. (4) El cliente est\u00e1 usando WebAuth. La vulnerabilidad no aplica a clientes .1x en la misma configuraci\u00f3n. Cisco Bug IDs: CSCvc79502, CSCvf71789."}], "lastModified": "2019-10-09T23:31:34.050", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:wireless_lan_controller_software:8.3\\(104.105\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64DEEBC6-28F9-4ACA-89E7-D4A74B48E44F"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:aironet_access_point_software:8.3\\(104.105\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B12FDDD-E8AA-4BE2-A938-09E63BC82F31"}, {"criteria": "cpe:2.3:o:cisco:aironet_access_point_software:8.5\\(107.52\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD5F5F1A-61D8-4433-A49D-2BA2FA40AEDB"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}