CVE-2018-7675: Potential Information Disclosure in Sentinel
In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the user does not log out but does go idle for a period of time. This in turn causes the interface to timeout so that it requires the user to re-authenticate. If another user is passing by and decides to login, their credentials are accepted. While The user does not inherit any of the other users privileges, they are able to view the previous screen. In this case it is possible that the user can see another users events or configuration information for whatever view is currently showing.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7675?
The severity of CVE-2018-7675 is classified as a medium risk due to session management issues.
How do I fix CVE-2018-7675?
To fix CVE-2018-7675, users should upgrade to NetIQ Sentinel version 8.1.x or later.
What are the implications of CVE-2018-7675?
CVE-2018-7675 may allow unauthorized access to user sessions after a timeout, potentially exposing sensitive information.
Which software versions are affected by CVE-2018-7675?
CVE-2018-7675 affects all versions of NetIQ Sentinel prior to 8.1.x.
What measures can I take to mitigate CVE-2018-7675?
To mitigate CVE-2018-7675, enforce stricter session timeout policies and encourage regular user logouts.