1. CVE-Search
  2. CVE-2018-10240
ID CVE-2018-10240
Summary SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. This session token's value can be brute-forced by an attacker to obtain the corresponding session cookie and hijack the user's session.
References
Vulnerable Configurations
  • cpe:2.3:a:solarwinds:serv-u:15.1.6:*:*:*:*:*:*:*
    cpe:2.3:a:solarwinds:serv-u:15.1.6:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 25-06-2018 - 17:04)
Impact:
Exploitability:
CWE CWE-331
CAPEC
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:N/A:N
refmap via4
misc https://www.bishopfox.com/news/2018/05/solarwinds-serv-u-managed-file-transfer-insufficient-session-id-entropy/
Last major update 25-06-2018 - 17:04
Published 16-05-2018 - 14:29
Last modified 25-06-2018 - 17:04
Back to Top