8.8high
CVE-2018-5385
Navarino Infinity web interface up to version 2.2 is prone to session fixation attacks
Published 8 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.0%
percentile 91%
Public exploits
0
none known
Summary
Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authentication in some installations. This could lead to phishing attacks that can bypass the two factor authentication that is present in some installations.
Exploit prediction (EPSS)
4.02% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- Navarino Infinity
Classification
- Weakness
- CWE-384 Session Fixation
References
- packetstormsecurity.com /files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html · x_refsource_MISC, x_transferred
- medium.com /%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3 · x_refsource_MISC, x_transferred
- securityfocus.com /bid/103544 · vdb-entry, x_refsource_BID, x_transferred
- kb.cert.org /vuls/id/184077 · third-party-advisory, x_refsource_CERT-VN, x_transferred
Sources
- CVE List: CVE-2018-5385
- NVD: CVE-2018-5385
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.