CVE-2018-7295

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-05-23 · updated 2026-06-17
Weakness: CWE-924

Description

ffxivlauncher.exe in Square Enix Final Fantasy XIV 4.21 and 4.25 on Windows is affected by Improper Enforcement of Message Integrity During Transmission in a Communication Channel, allowing a man-in-the-middle attacker to steal user credentials because a session retrieves global.js via http before proceeding to use https. This is fixed in Patch 4.3.

Affected products

Square-Enix Final Fantasy Xiv: 4.21, 4.25

References

https://raw.githubusercontent.com/WizardShotTheFood/advisories/master/CVE-2018-7295.txt
https://raw.githubusercontent.com/WizardShotTheFood/advisories/master/CVE-2018-7295.txt

Get alerted when CVE-2018-7295 or the next vulnerability affects your stack