PT-2018-10798 · Nec · Nec Univerge Sv9100 Webpro

Hyp3Rlinx · Publicado 2018-12-26 · Atualizado 2021-09-13 · CVE-2018-11741

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NEC Univerge Sv9100 WebPro version 6.00.00

Description The issue concerns Predictable Session IDs, which can lead to Account Information Disclosure. This occurs via specific URIs, such as 'Home.htm?sessionId=#####&GOTO(8)'.

Recommendations For NEC Univerge Sv9100 WebPro version 6.00.00, consider restricting access to the 'Home.htm' endpoint until a fix is available, and avoid using predictable session IDs to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-11741

Produtos afetados

Nec Univerge Sv9100 Webpro

Referências · 7

• 🔥 https://exploit-db.com/exploits/45942 · Exploit
• 🔥 http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/150610/NEC-Univerge-Sv9100-WebPro-6.00.00-Predictable-Session-ID-Cleartext-Passwords.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Dec/1 · Exploit
• https://osv.dev/vulnerability/CVE-2018-11741 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-11741 · Nota de Segurança
• https://t.me/cvenotify/20734 · Publicação no Telegram