PT-2018-11131 · Ecos · Ecos System Management Appliance

Franz Girlich + 2 · Publicado 2018-06-17 · Atualizado 2019-10-03 · CVE-2018-12335

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ECOS System Management Appliance (aka SMA) version 5.2.68

Description The issue concerns incorrect access control, allowing a user to compromise authentication keys and manipulate security configurations through unrestricted database access during Easy Enrollment.

Recommendations For version 5.2.68, consider restricting database access during Easy Enrollment to prevent unauthorized manipulation of security configurations and authentication keys. As a temporary workaround, limit access to the database to minimize the risk of exploitation.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2018-12335

Produtos afetados

Ecos System Management Appliance

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-12335 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-12335 · Aviso do Fabricante
• https://telematik.prakinf.tu-ilmenau.de/ecos-sbs/advisory.html · Nota