CVE-2018-7295

HIGH 8.1CVE-2018-7295 · Published 23/05/2018 · updated 17/06/2026

In short

CVE-2018-7295 is a HIGH (CVSS 8.1) vulnerability affecting final fantasy xiv (square-enix).
Chance of exploitation in the next 30 days (EPSS): 0.41%, higher than 35.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
final fantasy xiv square-enix	`= 4.21= 4.25`	No fix yet

Description

ffxivlauncher.exe in Square Enix Final Fantasy XIV 4.21 and 4.25 on Windows is affected by Improper Enforcement of Message Integrity During Transmission in a Communication Channel, allowing a man-in-the-middle attacker to steal user credentials because a session retrieves global.js via http before proceeding to use https. This is fixed in Patch 4.3.

References

raw.githubusercontent.com/WizardShotTheFood/advisories/master/CVE-2018-7295.txt · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free