Published: 02/02/2018 Updated: 03/10/2019

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.1 | Impact Score: 5.9 | Exploitability Score: 2.2

VMScore: 384

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

An issue exists in Flexense DiskBoss 8.8.16 and previous versions. Due to the usage of plaintext information from the handshake as input for the encryption key used for the encryption of the rest of the session, the server and client disclose sensitive information, such as the authentication credentials, to any man-in-the-middle (MiTM) listener.

Vulnerable Product	Search on Vulmon	Subscribe to Product
flexense diskboss

public CVE exploits

List of public exploits CVE Title Links CVE-2018-5261 DiskBoss <= 8816 - Sensitive Information Disclosure CVE-Details CVE-2018-5262 DiskBoss <= 8816 - Unauthenticated Remote Code Execution CVE-Details | Exploit-DB CVE-2018-11488 dtSearch Engine <= v79085381 - Denial of Service CVE-Details

Public exploits

List of public exploits CVE Title Links CVE-2018-5261 DiskBoss <= 8816 - Sensitive Information Disclosure CVE-Details CVE-2018-5262 DiskBoss <= 8816 - Unauthenticated Remote Code Execution CVE-Details | Exploit-DB CVE-2018-11488 dtSearch Engine <= v79085381 - Denial of Service CVE-Details

CWE-311 https://github.com/bitsadmin/exploits/tree/master/CVE-2018-5261 https://nvd.nist.gov https://github.com/code-developers/exploits

CVE-2018-5261

Vulnerability Summary

Github Repositories

References

Vulmon Search

About

Products

Connect