CVE-2018-12520
High
Description
An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard library in use by the host running the service and the username of the user whose session they're targeting can abuse the deterministic random number generation in order to hijack the user's session, thus escalating their access.
SeverityHigh
CVSS8.1
Exploit probability—
ProductNtopng
PublishedJul 5, 2018
First seenJul 5, 2018
How to fix
Update
- ntop ntopng3.4.180617 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ntop ntopng | 3.4 ≤ v < 3.4.180617 | 3.4.180617 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.