CVE Vulnerabilities

CVE-2018-10240

Insufficient Entropy

Published: May 16, 2018 | Modified: Jun 25, 2018
CVSS 3.x
7.3
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu

SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. This session tokens value can be brute-forced by an attacker to obtain the corresponding session cookie and hijack the users session.

Weakness

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Affected Software

Name Vendor Start Version End Version
Serv-u Solarwinds * 15.1.6

Potential Mitigations

References