CVE-2018-5384CWE-89

CVE-2018-5384: vulnerability in Navarino Infinity

Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection

Published · Updated

Follow this CVE+ Monitor Infinity

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 4.2%
Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user can get info from the underlying postgresql database that could lead into to total compromise of the product. The said script is available with no authentication.
Affected products
Navarino · Infinity
Related CVEs — Navarino Infinity

In the same product, most dangerous first.

CVE-2018-5386—Some Navarino Infinity functions placed in the URL can bypass any authentication mechanism leading to an information leakEPSS 4.5%CVE-2018-5385—Navarino Infinity web interface up to version 2.2 is prone to session fixation attacksEPSS 4.0%