Vulnerability in Ntop Ntopng

CVE-2018-12520

An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker w…

EPSS: 0.107 (95.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

References

  • cve@mitre.org (x_refsource_CONFIRM, Patch)
  • cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, exploit, x_refsource_EXPLOIT-DB)
  • cve@mitre.org (mailing-list, Exploit, x_refsource_FULLDISC, Mailing List, Third Party Advisory)
  • cve@mitre.org (Exploit, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-12520?
CVE-2018-12520 is a high-severity vulnerability in Ntop Ntopng, classified under Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG). CVSS score: 8.1/10. Published 2018-07-05.
How severe is CVE-2018-12520?
High severity. CVSS v3 base score is 8.1 out of 10.