CVE-2018-5354
High
Description
The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote attackers to execute code and escalate privileges via spoofing. When the client is configured to use HTTP, it does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP.
SeverityHigh
CVSS8.8
Exploit probability—
ProductAnixis Password Reset Client
PublishedSep 30, 2020
First seenSep 30, 2020
How to fix
Update
- anixis password_reset_client3.22 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| anixis password_reset_client | v < 3.22 | 3.22 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.