CVE-2018-7295

ffxivlauncher.exe in Square Enix Final Fantasy XIV 4.21 and 4.25 on Windows is affected by Improper Enforcement of Message Integrity During Transmission in a…

published May 23, 2018

CVSS
—
EPSS
0%
Percentile
34.5
In the wild
Unconfirmed
What it is

ffxivlauncher.exe in Square Enix Final Fantasy XIV 4.21 and 4.25 on Windows is affected by Improper Enforcement of Message Integrity During Transmission in a Communication Channel, allowing a man-in-the-middle attacker to steal user credentials because a session retrieves global.js via http before proceeding to use https. This is fixed in Patch 4.3.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00415 · 34.5th percentile
Published
2018-05-23T12:00Z
EPSS history
Timeline
  • 23 MAY 12:00Z
    ffxivlauncher.exe in Square Enix Final Fantasy XIV 4.21 and 4.25 on Windows is affected by Improper Enforcement of Message Integrity During Transmission in a…
    cvelistv5