« Volver al listado

CVE-2018-5403

Estado: ModificadaAlta (8.1)—

Imperva SecureSphere gateway (GW) running v13, for both pre-First Time Login or post-First Time Login (FTL), if the attacker knows the basic authentication passwords, the GW may be vulnerable to RCE through specially crafted requests, from the web access management interface.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Imperva — Securesphere

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-5403",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "Imperva",
          "product": "SecureSphere",
          "versions": [
            {
              "status": "affected",
              "version": "13.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-01-10T22:29:00.267",
  "references": [
    {
      "url": "https://www.exploit-db.com/exploits/45542",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/45542",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cret@cert.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Imperva SecureSphere gateway (GW) running v13, for both pre-First Time Login or post-First Time Login (FTL), if the attacker knows the basic authentication passwords, the GW may be vulnerable to RCE through specially crafted requests, from the web access management interface."
    },
    {
      "lang": "es",
      "value": "La puerta de enlace Imperva SecureSphere (GW) que ejecuta la versión 13, tanto para pre o post FTL (First Time Login), si el atacante conoce las contraseñas básicas de autenticación, el GW podría ser vulnerable a la ejecución remota de código mediante peticiones especialmente manipuladas, desde la interfaz web de gestión de acceso."
    }
  ],
  "lastModified": "2026-06-17T02:00:16.033",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:imperva:securesphere:13.0.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F98848E2-42C9-44E0-AB11-907638A5F708"
            },
            {
              "criteria": "cpe:2.3:a:imperva:securesphere:13.1.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF62F95D-A617-4F6B-BED8-CE3437807C9A"
            },
            {
              "criteria": "cpe:2.3:a:imperva:securesphere:13.2.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E3EC0272-1B04-47EF-9599-1D5DB5CBD273"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}