CVE-2018-5385CWE-384

Navarino Infinity web interface up to version 2.2 is prone to session fixation attacks

published July 24, 2018

CVSS
—
EPSS
4%
Percentile
90.5
In the wild
Unconfirmed
What it is

Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authentication in some installations. This could lead to phishing attacks that can bypass the two factor authentication that is present in some installations.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04019 · 90.5th percentile
Weakness
CWE-384 · Session Fixation
Published
2018-07-24T15:00Z
EPSS history
Timeline
  • 24 JUL 15:00Z
    Navarino Infinity web interface up to version 2.2 is prone to session fixation attacks
    cvelistv5