PT-2017-18067 · Emc · Emc Data Protection Advisor

Rgod · Publicado 2017-09-15 · Atualizado 2018-04-13 · CVE-2017-8013

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EMC Data Protection Advisor versions 6.3.x through 6.4.x before patch 130 EMC Data Protection Advisor versions 6.3.x before patch 67

Description The issue concerns undocumented accounts with hard-coded passwords and various privileges. The affected accounts are "Apollo System Test", emc.dpa.agent.logon, and emc.dpa.metrics.logon. An attacker with knowledge of the password could potentially use these accounts via REST APIs to gain unauthorized access, including potentially administrative privileges.

Recommendations For EMC Data Protection Advisor versions 6.3.x before patch 67, apply patch 67 to resolve the issue. For EMC Data Protection Advisor versions 6.4.x before patch 130, apply patch 130 to resolve the issue. As a temporary workaround, consider restricting access to the REST APIs until a patch is applied.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2017-8013

ZDI-17-811

Produtos afetados

Emc Data Protection Advisor

Referências · 6

• https://osv.dev/vulnerability/CVE-2017-8013 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-17-811 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-8013 · Nota de Segurança
• http://securityfocus.com/bid/100846 · Nota
• http://seclists.org/fulldisclosure/2017/Sep/36 · Nota
• http://securitytracker.com/id/1039370 · Nota