PT-2018-10978 · Dell Emc · Dell Emc Data Protection Advisor

Publicado 2018-03-12 · Atualizado 2018-04-13 · CVE-2018-1206

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110

Description The issue concerns a hardcoded database account with administrative privileges, specifically the account apollosuperuser. An attacker with local access to the server where DPA Datastore Service is installed and knowledge of the password may potentially gain unauthorized access to the database. It is noted that the Datastore Service database cannot be accessed remotely using this account.

Recommendations For Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159, update to version 6.3 Patch 159 or later. For Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110, update to version 6.4 Patch 110 or later.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2018-1206

Produtos afetados

Dell Emc Data Protection Advisor

Referências · 5

• https://osv.dev/vulnerability/CVE-2018-1206 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2018/Mar/22 · Nota
• http://securitytracker.com/id/1040484 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1206 · Nota de Segurança
• http://securityfocus.com/bid/103376 · Nota