# CVE-2018-7675: Potential Information Disclosure in Sentinel

> An attacker can view another user's session data after idle timeout due to improper session termination in NetIQ Sentinel.

- **Severity:** Low 2.8 (`CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** A user has to click or open something
- **Fix available:** No
- **Published:** 7 Mar 2018
- **Updated:** 5 Aug 2024
- **Also known as:** GHSA-m7qw-mwjx-2vpf

## What is CVE-2018-7675?

CVE-2018-7675 is a low-severity vulnerability in NetIQ Corporation Sentinel, published on 7 Mar 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

### Official description

In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the user does not log out but does go idle for a period of time. This in turn causes the interface to timeout so that it requires the user to re-authenticate. If another user is passing by and decides to login, their credentials are accepted. While The user does not inherit any of the other users privileges, they are able to view the previous screen. In this case it is possible that the user can see another users events or configuration information for whatever view is currently showing.

Weakness: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)

## Which versions are affected by CVE-2018-7675?

It affects 1 product.


Products: Microfocus Sentinel.

## How do I fix CVE-2018-7675?

No fix has been published for CVE-2018-7675 yet. Limit exposure of the affected software until one is available.

## Is CVE-2018-7675 being exploited?

There is no known exploitation of CVE-2018-7675 in the wild and no public exploit code.

## Other vulnerabilities in NetIQ Corporation Sentinel

- [CVE-2017-5185](https://insights.sbomify.com/CVE-2017-5185/): Denial of service in NetIQ Sentinel Server (high 7.5)
- [CVE-2014-3460](https://insights.sbomify.com/CVE-2014-3460/): Path traversal in n/a (medium 6.8)
- [CVE-2017-5184](https://insights.sbomify.com/CVE-2017-5184/): Information disclosure in NetIQ Sentinel Server (medium 5.3)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2018-7675 and fix it if it is affected.

What it is: CVE-2018-7675 is a low-severity vulnerability in NetIQ Corporation Sentinel, published on 7 Mar 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of CVE-2018-7675 in the wild and no public exploit code.

Affected product: NetIQ Corporation Sentinel. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2018-7675/ (Markdown: https://insights.sbomify.com/CVE-2018-7675/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2018-7675
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2018-7675
- OSV: https://osv.dev/vulnerability/CVE-2018-7675

---
From sbomify Insights: https://insights.sbomify.com/CVE-2018-7675/
Summaries are generated and may contain mistakes; the official description above is the record.