What is the CVSS score of CVE-2018-11652?

CVE-2018-11652 has a CVSS 3.0 base score of 9.8 (Critical). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 24.7%.

Is there a public PoC exploit available for CVE-2018-11652?

Yes, a public proof-of-concept exploit is available for CVE-2018-11652. Prioritise patching immediately. EPSS: 24.7%.

Is there a patch available for CVE-2018-11652?

Yes, a patch is available for CVE-2018-11652. Update the affected software to the latest version immediately.

Nikto CVE-2018-11652

CRITICAL

Improper Neutralization of Formula Elements in a CSV File (CWE-1236)

2018-06-01 cve@mitre.org

Code Injection Nikto

9.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jun 01, 2018 - 15:29 nvd

CRITICAL 9.8

DescriptionNVD

AnalysisAI

CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-1236. CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report. Affected products include: Cirt.Net Nikto.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.