PT-2018-15355 · Safe · Fme Server

Publicado 2018-12-23 · Atualizado 2019-10-03 · CVE-2018-20402

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Safe Software FME Server versions prior to 2018.1

Description The issue allows unauthorized access by creating and enabling three additional accounts with default passwords. The accounts have usernames that are the same as their passwords: guest, user, and author. These accounts are granted default privilege roles, which can be exploited by logging in with these credentials.

Recommendations For Safe Software FME Server versions prior to 2018.1, change the default passwords of the guest, user, and author accounts to secure passwords to prevent unauthorized access. Consider disabling these accounts if they are not necessary for the system's operation.

Correção

Enumeração de Fraquezas

CWE-1188

Identificadores relacionados

CVE-2018-20402

Produtos afetados

Fme Server

Referências · 3

• http://docs.safe.com/fme/html/FME_Server_Documentation/Content/AdminGuide/Default_User_Accounts_and_Passwords.htm · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-20402 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-20402 · Aviso do Fabricante