CVE-2018-5386 Some Navarino Infinity functions placed in the URL can bypass any authentication mechanism leading to an information leak

2018-07-2415:00:00

CWE-288

certcc

www.cve.org

AI Score

8.1

Confidence

High

EPSS

0.009

Percentile

82.4%

JSON

Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading to an information leak.

CNA Affected

[
  {
    "product": "Infinity",
    "vendor": "Navarino",
    "versions": [
      {
        "lessThan": "2.2",
        "status": "affected",
        "version": "2.2",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/103544

medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3

packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html

www.kb.cert.org/vuls/id/184077