Potential Information Disclosure in Sentinel
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the user does not log out but does go idle for a period of time. This in turn causes the interface to timeout so that it requires the user to re-authenticate. If another user is passing by and decides to login, their credentials are accepted. While The user does not inherit any of the other users privileges, they are able to view the previous screen. In this case it is possible that the user can see another users events or configuration information for whatever view is currently showing.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NetIQ | Sentinel | Sentinel 8.1.X 8.1.X | — | No fix listed | CNA |
- Sentinel VendorNetIQ Affected Sentinel 8.1.X 8.1.X Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microfocus:sentinel:*:*:*:*:*:*:*:* | up to 8.1 | Vulnerable | Micro Focus International |
- cpe:2.3:a:microfocus:sentinel:*:*:*:*:*:*:*:* Versions up to 8.1 Vulnerable ·Micro Focus International
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-7675
- 2026-10-03 Alias added: GHSA-m7qw-mwjx-2vpf
References
More NetIQ vulnerabilities
- TI-2017-10842 In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a… CVSS 3.0CRITICAL 9.8
- TI-2018-01243 PAM exposure enabling unauthenticated access to remote host CVSS 3.0CRITICAL 9.8
- TI-2017-05084 Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1… CVSS 3.0CRITICAL 9.8
- TI-2016-04998 Information disclosure in NetIQ Access Manager CVSS 3.0CRITICAL 9.8
- TI-2018-01242 Unrestricted file upload in Micro Focus NetIQ Access Manager, Administrative Console CVSS 3.0CRITICAL 9.8
- TI-2017-06726 Login restrictions not applied when using ebaclient against NetIQ eDirectory EBA interface CVSS 3.0CRITICAL 9.8
Sources
- CVE-2018-7675 · CVE Program
- CVE-2018-7675 · NVD
- FIRST EPSS
- GHSA-m7qw-mwjx-2vpf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences