CVE-2018-7259

CRITICAL

Flight Sim Labs A320-X 2.0.1.231 - Cleartext Transmission of Sensitive Information via Installer Log Handler

Title source: llm

Description

The FSX / P3Dv4 installer 2.0.1.231 for Flight Sim Labs A320-X sends a user's Google account credentials to http://installLog.flightsimlabs.com/LogHandler3.ashx if a pirated serial number has been entered, which allows remote attackers to obtain sensitive information, e.g., by sniffing the network for cleartext HTTP traffic. This behavior was removed in 2.0.1.232.

References (3)

Core 3

Core References

Issue Tracking, Press/Media Coverage x_refsource_misc

https://www.reddit.com/r/flightsim/comments/7yh4zu/fslabs_a320_installer_seems_to_include_a_chrome/

Issue Tracking x_refsource_misc

https://forums.flightsimlabs.com/index.php?/topic/16210-malware-in-installer/

Various Sources x_refsource_misc

https://medium.com/%40lukegorman97/flightsimlabs-alleged-malware-analysis-1427c4d23368

Scores

CVSS v3 9.8

EPSS 0.0101

EPSS Percentile 58.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-319

Status published

Products (1)

flightsimlabs/a320-x 2.0.1.231

Published Feb 20, 2018

Tracked Since Feb 18, 2026