CVEvulnerability
CVE-2018-5385
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-07-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-384
Description
Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authentication in some installations. This could lead to phishing attacks that can bypass the two factor authentication that is present in some installations.
Affected configurations
• navarino infinity (< 2.2)
Related
Weakness · CWE (1)
- CWE-384 Session Fixation weakness
References
- http://www.securityfocus.com/bid/103544 Third Party Advisory, VDB Entry
- https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3 medium.com
- https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html Exploit, Third Party Advisory, VDB Entry
- https://www.kb.cert.org/vuls/id/184077 Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/103544 Third Party Advisory, VDB Entry
- https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3 medium.com
- https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html Exploit, Third Party Advisory, VDB Entry
- https://www.kb.cert.org/vuls/id/184077 Third Party Advisory, US Government Resource