A vulnerability classified as critical was found in NetIQ SENTINEL up to 8.0.x. This vulnerability affects an unknown function of the component Web Interface. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the user does not log out but does go idle for a period of time. This in turn causes the interface to timeout so that it requires the user to re-authenticate. If another user is passing by and decides to login, their credentials are accepted. While The user does not inherit any of the other users privileges, they are able to view the previous screen. In this case it is possible that the user can see another users events or configuration information for whatever view is currently showing.

The bug was discovered 03/07/2018. The weakness was shared 03/07/2018 (Website). The advisory is shared for download at netiq.com. This vulnerability was named CVE-2018-7675 since 03/05/2018. The attack can be initiated remotely. The successful exploitation requires a single authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 8.1.x eliminates this vulnerability.

Productinfo

Vendor

• NetIQ

Name

• SENTINEL

Version

• 8.0

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion