CVE-2018-1139CWE-20

A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled

Medium · published August 22, 2018

CVSS v3.0
5.4
EPSS
3%
Percentile
87.7
In the wild
Unconfirmed
What it is

A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.

The record
Technical detail
CVSS v3.0
5.4 · MEDIUM
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.03105 · 87.7th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2018-08-22T14:00Z
EPSS history
Timeline
  • 22 AUG 14:00Z
    A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled
    cvelistv5