8.1high
CVE-2018-5261
An issue was discovered in Flexense DiskBoss 8.8.16 and earlier.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
8.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 40%
Public exploits
0
none known
Summary
An issue was discovered in Flexense DiskBoss 8.8.16 and earlier. Due to the usage of plaintext information from the handshake as input for the encryption key used for the encryption of the rest of the session, the server and client disclose sensitive information, such as the authentication credentials, to any man-in-the-middle (MiTM) listener.
Exploit prediction (EPSS)
0.46% probability of exploitation in the next 30 days, higher than 40% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Classification
- Weakness
- CWE-311 Missing Encryption of Sensitive Data
References
- github.com /bitsadmin/exploits/tree/master/CVE-2018-5261 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-5261
- NVD: CVE-2018-5261
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.