PT-2017-3058 · Emc · Emc Elastic Cloud Storage

Publicado 2017-09-26 · Atualizado 2020-08-19 · CVE-2017-8021

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EMC Elastic Cloud Storage (ECS) versions prior to 3.1

Description The issue is related to an undocumented account vulnerability that could be leveraged by malicious users to compromise the system. It is also associated with the use of a pre-installed account, specifically emcservice, which has a predefined password. Exploitation of this issue may allow a remote attacker to access the system, compromising the confidentiality, integrity, and availability of data.

Recommendations For versions prior to 3.1, consider changing the password of the pre-installed emcservice account to prevent unauthorized access. As a temporary workaround, restrict access to the system to minimize the risk of exploitation until a patch is available. Update to version 3.1 or later to fully resolve the issue.

Correção

Enumeração de Fraquezas

CWE-255

CWE-1188

Identificadores relacionados

BDU:2017-02427

CVE-2017-8021

Produtos afetados

Emc Elastic Cloud Storage

Referências · 6

• https://bdu.fstec.ru/vul/2017-02427 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-8021 · Nota de Segurança
• https://packetstormsecurity.com/files/144375/EMC-Elastic-Cloud-Storage-Undocumented-Account.html · Nota
• https://osv.dev/vulnerability/CVE-2017-8021 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2017/Sep/74 · Nota
• http://securityfocus.com/bid/101018 · Nota