CVE-2018-7675

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the user does not log out but does go idle for a period of time. This in turn causes the interface to timeout so that it requires the user to re-authenticate. If another user is passing by and decides to login, their credentials are accepted. While The user does not inherit any of the other users privileges, they are able to view the previous screen. In this case it is possible that the user can see another users events or configuration information for whatever view is currently showing.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Mar 7, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-76765.9The NetIQ Identity Manager, in versions prior to 4.7, userapp with log / trace enabled may leak sensitive information.CVE-2018-76778.8A CSRF exposure exists in NetIQ Access Manager (NAM) 4.4 Identity Server component.CVE-2018-76784.8A cross site scripting vulnerability exist in the Administration Console in NetIQ Access Manager (NAM) 4.3 and 4.4.CVE-2018-76799.8Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories CVE-2018-76806.1Micro Focus Solutions Business Manager versions prior to 11.4 can reflect back HTTP header values.CVE-2018-76814.8Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder. If the CVE-2018-76826.5Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domains.CVE-2018-76837.5Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log files.CVE-2018-76857.8The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later CVE-2018-76867.5Information leakage vulnerability in NetIQ eDirectory before 9.1.1 HF1 due to shared memory usage.CVE-2018-76877.8The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a b CVE-2018-76886.5A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sour