CVE Vulnerability

CVE-2018-5261

An issue was discovered in Flexense DiskBoss 8.8.16 and earlier. Due to the usage of plaintext information from the handshake as input for the encryption key used for the encryption of the rest of the session, the server and client disclose sensitive information, such as the authentication credentials, to any man-in-the-middle (MiTM) listener.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

8.1 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/bitsadmin/exploits/tree/master/CVE-2018-5261 Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:flexense:diskboss:*:*:*:*:*:*:*:*
Information

Published : 2018-02-02 09:29

Updated : 2019-10-03 12:03

NVD link : CVE-2018-5261

Mitre link : CVE-2018-5261

Products Affected
No products.
CWE
CWE-311

Missing Encryption of Sensitive Data