CVE-2018-1139 MEDIUM

CVE-2018-1139

Vendor The Samba Team
Product samba
Weakness CWE-20 · Input validation
Published August 22, 2018
Last update August 5, 2024

CVSS base score

5.4/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.

Key dates

02Disclosure timeline

August 22, 2018 CVE published
August 5, 2024 Record updated