VDB
CVE-2018-5384
CVE-2018-5384
PUBLISHED
CVSS 5 MEDIUM
Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user can get info from the underlying postgresql database that could lead into to total compromise of the product. The said script is available with no authentication.
EPSS 2.34% · 85.2th percentile
Risk Scores
CVSS 2.0
5
EPSS Score
2.34%
85.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| navarino | infinity | 0 |
| Navarino | Infinity | 2.2 |
Timeline
- Jul 24, 2018 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Feb 28, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
- Jan 8, 2023 EPSS Score
- Mar 11, 2023 EPSS Score
- May 13, 2023 EPSS Score
References
- https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html url
- https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3 url
- 103544 vdb
- VU#184077 third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-5384 advisory
- https://medium.com/@evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3 url