CVE-2018-11741

Опубликовано: 26 дек. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 5

EPSS Средний

Описание

NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId=#####&GOTO(8) URIs.

Ссылки

http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/150610/NEC-Univerge-Sv9100-WebPro-6.00.00-Predictable-Session-ID-Cleartext-Passwords.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2018/Dec/1
Exploit
Mailing List
Third Party Advisory
https://www.exploit-db.com/exploits/45942/
Exploit
Third Party Advisory
VDB Entry
http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/150610/NEC-Univerge-Sv9100-WebPro-6.00.00-Predictable-Session-ID-Cleartext-Passwords.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2018/Dec/1
Exploit
Mailing List
Third Party Advisory
https://www.exploit-db.com/exploits/45942/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:nec:univerge_sv9100_webpro_firmware:6.00.00:*:*:*:*:*:*:*

cpe:2.3:h:nec:univerge_sv9100_webpro:-:*:*:*:*:*:*:*

EPSS

Процентиль: 98%

0.527

Средний

9.8 Critical

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-vx78-82wr-r3gg