{"api_version":"1","generated_at":"2026-07-23T06:09:09+00:00","cve":"CVE-2018-5384","urls":{"html":"https://cve.report/CVE-2018-5384","api":"https://cve.report/api/cve/CVE-2018-5384.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-5384","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-5384"},"summary":{"title":"CVE-2018-5384","description":"Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user can get info from the underlying postgresql database that could lead into to total compromise of the product. The said script is available with no authentication.","state":"PUBLIC","assigner":"cert@cert.org","published_at":"2018-07-24 15:29:00","updated_at":"2023-11-07 02:58:00"},"problem_types":["CWE-89"],"metrics":[],"references":[{"url":"http://www.securityfocus.com/bid/103544","name":"103544","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"Navarino Infinity VU#184077 Multiple Security Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3","name":"https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3","refsource":"","tags":[],"title":"Row, row, row your boat: Pwning ship’s VSAT for fun and profit.","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html","name":"https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"],"title":"Navarino Infinity Blind SQL Injection / Session Fixation ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://medium.com/@evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3","name":"https://medium.com/@evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3","refsource":"MISC","tags":["Exploit","Press/Media Coverage","Third Party Advisory"],"title":"Row, row, row your boat: Pwning ship’s VSAT for fun and profit.","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.kb.cert.org/vuls/id/184077","name":"VU#184077","refsource":"CERT-VN","tags":["Third Party Advisory","US Government Resource"],"title":"VU#184077 - Navarino Infinity web interface is affected by multiple vulnerabilities.","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-5384","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-5384","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"5384","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"navarino","cpe5":"infinity","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"5384","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"navarino","cpe5":"infinity","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cert@cert.org","ID":"CVE-2018-5384","STATE":"PUBLIC","TITLE":"Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Infinity","version":{"version_data":[{"affected":"<","version_name":"2.2","version_value":"2.2"}]}}]},"vendor_name":"Navarino"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user can get info from the underlying postgresql database that could lead into to total compromise of the product. The said script is available with no authentication."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-89"}]}]},"references":{"reference_data":[{"name":"https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html","refsource":"MISC","url":"https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html"},{"name":"https://medium.com/@evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3","refsource":"MISC","url":"https://medium.com/@evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3"},{"name":"103544","refsource":"BID","url":"http://www.securityfocus.com/bid/103544"},{"name":"VU#184077","refsource":"CERT-VN","url":"https://www.kb.cert.org/vuls/id/184077"}]},"source":{"discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2018-07-24 15:29:00","lastModifiedDate":"2023-11-07 02:58:00","problem_types":["CWE-89"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:navarino:infinity:*:*:*:*:*:*:*:*","versionEndExcluding":"2.2","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"5384","Ordinal":"121354","Title":"CVE-2018-5384","CVE":"CVE-2018-5384","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"5384","Ordinal":"1","NoteData":"Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user can get info from the underlying postgresql database that could lead into to total compromise of the product. The said script is available with no authentication.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"5384","Ordinal":"2","NoteData":"2018-07-24","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"5384","Ordinal":"3","NoteData":"2018-07-25","Type":"Other","Title":"Modified"}]}}}