CVE-2018-8902
published 2018-06-29CVE-2018-8902: An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. The impacted products used a single shared key encryption model to encrypt…
PriorityP336medium6.5CVSS 3.0
AVNACLPRLUINSUCHINAN
EPSS
1.74%
74.9th percentile
An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. The impacted products used a single shared key encryption model to encrypt data. A user with access to system databases can use the discovered key to access potentially confidential stored data, which may include Wi-Fi passwords. This discovered key can be used for all instances of the product.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ivanti | avalanche | 5.3 – 6.2 | — |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ivanti
Ivanti Security Advisory: CVE-2018-8902
vendor_ivanti·2018-06-29·CVSS 6.5
CVE-2018-8902 [MEDIUM] CWE-287 Ivanti Security Advisory: CVE-2018-8902
Ivanti Security Advisory: CVE-2018-8902
An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. The impacted products used a single shared key encryption model to encrypt data. A user with access to system databases can use the discovered key to access potentially confidential stored data, which may include Wi-Fi passwords. This discovered key can be used for all instances of the product.
CVE IDs: CVE-2018-8902
CVSS Base Score: 6.5
Severity: MEDIUM
CWEs: CWE-287
GHSA
GHSA-fwc5-p88w-fh8w: An issue was discovered in Ivanti Avalanche for all versions between 5
ghsa_unreviewed·2022-05-13
CVE-2018-8902 [MEDIUM] CWE-287 GHSA-fwc5-p88w-fh8w: An issue was discovered in Ivanti Avalanche for all versions between 5
An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. The impacted products used a single shared key encryption model to encrypt data. A user with access to system databases can use the discovered key to access potentially confidential stored data, which may include Wi-Fi passwords. This discovered key can be used for all instances of the product.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-06-29
Published