CVE-2018-12472

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A improper authentication using the HOST header in SUSE Linux SMT allows remote attackers to spoof a sibling server. Affected releases are SUSE Linux SMT: versions prior to 3.0.37.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Oct 4, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-124737.5A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause access files not in t CVE-2018-124749.8Improper input validation in obs-service-tar_scm of Open Build Service allows remote attackers to cause access and extract information outsi CVE-2018-124755.4A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-download_files of openSUSE Open Build Service CVE-2018-124767.5Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers wi CVE-2018-124777.5A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by CVE-2018-124786.5A Improper Input Validation vulnerability in Open Build Service allows remote attackers to extract files from the system where the service r CVE-2018-124797.5A Improper Input Validation vulnerability in Open Build Service allows remote attackers to cause DoS by specifying crafted request IDs. Affe CVE-2018-12486.1RSA Authentication Manager Security Console, Operation Console and Self-Service Console, version 8.3 and earlier, is affected by a Host head CVE-2018-124806.1Mitigates an XSS issue in NetIQ Access Manager versions prior to 4.4 SP3.CVE-2018-124819.8The Olive Tree Ftp Server application 1.32 for Android has a "Sensitive Data on the Clipboard" vulnerability, as demonstrated by reading the CVE-2018-124828.8OCS Inventory 2.4.1 contains multiple SQL injections in the search engine. Authentication is needed in order to exploit the issues.CVE-2018-124838.8OCS Inventory 2.4.1 is prone to a remote command-execution vulnerability. Specifically, this issue occurs because the content of the ipdisco