CVE-2018-10240

SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. This session token's value can be brute-forced by an attacker to obtain the corresponding session cookie and hijack the user's session.
Configurations

Configuration 1

cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*

Information

Published : 2018-05-16 02:29

Updated : 2018-06-25 05:04


NVD link : CVE-2018-10240

Mitre link : CVE-2018-10240

Products Affected
No products.
CWE
CWE-331

Insufficient Entropy