CVE-2018-7739

antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters, as demonstrated by a username=>&password=%0a string to the /login URI. This allows obtaining root permissions within the web management console, because the login process uses Java's ProcessBuilder class and a bash script called antsle-auth with insufficient input validation.

• CWE-20

• http://blog.codecatoctin.com/2018/02/antman-authentication-bypass.htmlExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/44220/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/44262/Exploit, Third Party Advisory, VDB Entry
• http://blog.codecatoctin.com/2018/02/antman-authentication-bypass.htmlExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/44220/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/44262/Exploit, Third Party Advisory, VDB Entry

Published

Mar 7, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7733An issue was discovered in YxtCMF 3.1. RbacController.class.…
• CVE-2018-7734Afian FileRun (before 2018.02.13) suffers from a remote SQL …
• CVE-2018-7735Afian FileRun (before 2018.02.13) suffers from a remote SQL …
• CVE-2018-7736In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUB…
• CVE-2018-7737In Z-BlogPHP 1.5.1.1740, there is Web Site physical path lea…
• CVE-2018-7738In util-linux before 2.32-rc1, bash-completion/umount allows…
• CVE-2018-7740The resv_map_release function in mm/hugetlb.c in the Linux k…
• CVE-2018-7741Eramba e1.0.6.033 has Reflected XSS in the Date Filter via t…
• CVE-2018-7745An issue was discovered in Western Bridge Cobub Razor 0.7.2.…7.5
• CVE-2018-7746An issue was discovered in Western Bridge Cobub Razor 0.7.2.…8.8
• CVE-2018-7747Multiple cross-site scripting (XSS) vulnerabilities in the C…
• CVE-2018-7748report_viewer.do in ServiceNow Release Jakarta Patch 8 and e…