Vulnerabilities

TI-2018-03919 CVE-2018-5386 · GHSA-x93w-rxpc-g58g

Authentication bypass in Navarino Infinity

MEDIUM 40

Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading to an information leak.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04461 Published 2018-07-24 Fixed in 2.2 CWE-288

TI-2018-03918 CVE-2018-5385 · GHSA-g9mm-555g-3956

MEDIUM 45

Navarino Infinity is prone to session fixation attacks.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.04019 Published 2018-07-24 Fixed in 2.2 CWE-384

TI-2018-03917 CVE-2018-5384 · GHSA-pj2p-xpf5-qc8h

MEDIUM 49

Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04199 Published 2018-07-24 Fixed in 2.2 CWE-89