PT-2018-2004 · Postgresql+1 · Postgresql+1
Publicado
2018-12-04
·
Atualizado
2019-01-02
·
CVE-2018-0468
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Cisco Energy Management Suite (affected versions not specified)
Description
The issue is related to the configuration of a local database in the Cisco Energy Management Suite, specifically due to the use of default access credentials for the PostgreSQL database. This could allow an authenticated, local attacker to access and modify confidential data by logging in to the machine where the suite is installed and establishing a local connection to the database.
Recommendations
For existing installations, manually change the database access password as documented in the Workarounds section of the advisory.
For new installations, ensure the fix that randomizes the database access password is applied.
As a temporary workaround, consider restricting access to the PostgreSQL database to minimize the risk of exploitation.
Correção
Using Hardcoded Credentials
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cisco Energy Management Suite
Postgresql