Vulnerability Description
In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the user does not log out but does go idle for a period of time. This in turn causes the interface to timeout so that it requires the user to re-authenticate. If another user is passing by and decides to login, their credentials are accepted. While The user does not inherit any of the other users privileges, they are able to view the previous screen. In this case it is possible that the user can see another users events or configuration information for whatever view is currently showing.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microfocus | Sentinel | <= 8.1 |
Related Weaknesses (CWE)
References
- https://www.netiq.com/support/kb/doc.php?id=7022706
- https://www.netiq.com/support/kb/doc.php?id=7022706
FAQ
What is CVE-2018-7675?
CVE-2018-7675 is a vulnerability with a CVSS score of 2.8 (LOW). In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the user does not log out but does go idle for a period of time. ...
How severe is CVE-2018-7675?
CVE-2018-7675 has been rated LOW with a CVSS base score of 2.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-7675?
Check the references section above for vendor advisories and patch information. Affected products include: Microfocus Sentinel.