{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2018-7675 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2018-7675 yet. Limit exposure of the affected software until one is available.","what":"CVE-2018-7675 is a low-severity vulnerability in NetIQ Corporation Sentinel, published on 7 Mar 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2018-7675 and fix it if it is affected.\n\nWhat it is: CVE-2018-7675 is a low-severity vulnerability in NetIQ Corporation Sentinel, published on 7 Mar 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2018-7675 in the wild and no public exploit code.\n\nAffected product: NetIQ Corporation Sentinel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2018-7675/ (Markdown: https://insights.sbomify.com/CVE-2018-7675/index.md)","id":"CVE-2018-7675","markdown":"https://insights.sbomify.com/CVE-2018-7675/index.md","name":"CVE-2018-7675","record":{"aliases":["GHSA-m7qw-mwjx-2vpf"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"NetIQ Sentinel","requires_auth":"low_privilege","summary":"An attacker can view another user's session data after idle timeout due to improper session termination in NetIQ Sentinel.","user_interaction":"required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"microfocus","cpe":[{"product":"sentinel","vendor":"microfocus"}],"cvss":{"score":2.8,"severity":"low","source":"cna","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","version":"3.0"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"description":"In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the user does not log out but does go idle for a period of time. This in turn causes the interface to timeout so that it requires the user to re-authenticate. If another user is passing by and decides to login, their credentials are accepted. While The user does not inherit any of the other users privileges, they are able to view the previous screen. In this case it is possible that the user can see another users events or configuration information for whatever view is currently showing.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Potential Information Disclosure in Sentinel","id":"CVE-2018-7675","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"information_disclosure","year":"2018"},"n_packages":0,"n_references":1,"next":{"headline":"IDM Information Leakage","id":"CVE-2018-7676"},"packages":[],"prev":{"headline":"IDM URL Redirection attack","id":"CVE-2018-7674"},"products":["Sentinel"],"published":"2018-03-07","related":[{"cvss_score":7.5,"headline":"Denial of service in NetIQ Sentinel Server","id":"CVE-2017-5185","kev_date_added":null,"published":"2017-03-30"},{"cvss_score":6.8,"headline":"Path traversal in n/a","id":"CVE-2014-3460","kev_date_added":null,"published":"2014-05-20"},{"cvss_score":5.3,"headline":"Information disclosure in NetIQ Sentinel Server","id":"CVE-2017-5184","kev_date_added":null,"published":"2017-03-30"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-05","vendors":["NetIQ Corporation"]},"summary":"An attacker can view another user's session data after idle timeout due to improper session termination in NetIQ Sentinel.","url":"https://insights.sbomify.com/CVE-2018-7675/"}