PT-2017-16239 · Emc · Emc Esrs Policy Manager

Travis Emmert · Publicado 2017-07-09 · Atualizado 2019-10-03 · CVE-2017-4976

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EMC ESRS Policy Manager versions prior to 6.8

Description The issue concerns an undocumented account, specifically the OpenDS admin, which has a default password. This allows a remote attacker who knows the default password to log in and gain administrator privileges to the local LDAP directory server.

Recommendations For versions prior to 6.8, change the default password of the OpenDS admin account to prevent unauthorized access. As a temporary workaround, consider restricting access to the LDAP directory server until the default password is changed.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2017-4976

Produtos afetados

Emc Esrs Policy Manager

Referências · 4

• http://seclists.org/fulldisclosure/2017/Jul/13 · Nota
• http://securitytracker.com/id/1038840 · Nota
• https://osv.dev/vulnerability/CVE-2017-4976 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-4976 · Nota de Segurança