CVE-2018-5385CWE-384

CVE-2018-5385: vulnerability in Navarino Infinity

Navarino Infinity web interface up to version 2.2 is prone to session fixation attacks

Published · Updated

Follow this CVE+ Monitor Infinity

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 4.0%
Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authentication in some installations. This could lead to phishing attacks that can bypass the two factor authentication that is present in some installations.
Affected products
Navarino · Infinity
Related CVEs — Navarino Infinity

In the same product, most dangerous first.

CVE-2018-5386—Some Navarino Infinity functions placed in the URL can bypass any authentication mechanism leading to an information leakEPSS 4.5%CVE-2018-5384—Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injectionEPSS 4.2%