High severity · published Aug 2, 2018
CVE-2018-1154
In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of username aliases via brute force,…
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of username aliases via brute force, ultimately facilitating unauthorized access. Server response output has been unified to correct this issue.
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
SecurityCenter · Tenable
All versions prior to 5.7.0 · source: vendor
SC
Security Center · Tenable
before 5.7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1154
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1154
Third Party Advisory
http://www.securitytracker.com/id/1041431
Patch
https://www.tenable.com/security/tns-2018-11
More from SecurityCenter
5.4
CVE-2018-1155
In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter…