// For flags

CVE-2018-8902

 

Severity Score

6.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. The impacted products used a single shared key encryption model to encrypt data. A user with access to system databases can use the discovered key to access potentially confidential stored data, which may include Wi-Fi passwords. This discovered key can be used for all instances of the product.

Se ha descubierto un problema en Ivanti Avalanche para todas las versiones entre la 5.3 y la 6.2. Los productos afectados utilizaron un único modelo de cifrado de clave compartida para cifrar los datos. Un usuario con acceso a las bases de datos del sistema puede utilizar la clave descubierta para acceder a datos almacenados potencialmente confidenciales,pudiendo incluir contraseñas Wi-Fi. Esta clave descubierta se puede utilizar para todas las instancias del producto.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-03-21 CVE Reserved
  • 2018-06-29 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-287: Improper Authentication
CAPEC
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
URL Date SRC
https://community.ivanti.com/docs/DOC-68406 2019-10-03
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Ivanti
Search vendor "Ivanti"
 Avalanche
Search vendor "Ivanti" for product "Avalanche"
 >= 5.3 <= 6.2
Search vendor "Ivanti" for product "Avalanche" and version " >= 5.3 <= 6.2"
-
Affected