PT-2018-13751 · Solarwinds · Solarwinds Sftp/Scp Server

Alex Craggs · Publicado 2018-12-05 · Atualizado 2019-10-03 · CVE-2018-16791

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SolarWinds SFTP/SCP Server versions prior to 2018-09-10

Description The configuration file of the affected software is world readable and writable, storing user passwords insecurely. This allows an attacker to determine passwords for potentially privileged accounts and grants the ability to backdoor the server.

Recommendations For versions prior to 2018-09-10, restrict access to the configuration file to prevent unauthorized modifications and reading of sensitive information. As a temporary workaround, consider implementing additional access controls to limit the potential impact of the insecure password storage.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2018-16791

Produtos afetados

Solarwinds Sftp/Scp Server

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-16791 · Aviso do Fabricante
• https://seclists.org/fulldisclosure/2018/Dec/0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-16791 · Nota de Segurança