High severity · published Feb 2, 2018
CVE-2018-5261
An issue was discovered in Flexense DiskBoss 8.8.16 and earlier
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
An issue was discovered in Flexense DiskBoss 8.8.16 and earlier. Due to the usage of plaintext information from the handshake as input for the encryption key used for the encryption of the rest of the session, the server and client disclose sensitive information, such as the authentication credentials, to any man-in-the-middle (MiTM) listener.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
Diskboss · Flexense
through 8.8.16 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-5261
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-5261
Exploit
https://github.com/bitsadmin/exploits/tree/master/CVE-2018-5261
More from Diskboss
9.8
CVE-2018-5262
A stack-based buffer overflow in Flexense DiskBoss 8.8.16 and earlier allows unauthenticated remote attackers to execute arbitrary code in the context of a highly privileged…
7.8
CVE-2020-36881
Flexsense DiskBoss 'Add Input Directory' Buffer Overflow
7.8
CVE-2020-36880
Flexsense DiskBoss 'Reports and Data Directory' Buffer Overflow
7.8
CVE-2017-7310
A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9, DiskPulse before 10.6, DiskSavvy before 10.6, DupScout…
7.5
CVE-2020-36882
Flexsense DiskBoss Application Crash Denial of Service