PT-2018-3856 · Dell Emc+1 · Dell Emc Networker+1
Publicado
2018-08-01
·
Atualizado
2019-10-03
·
CVE-2018-11050
CVSS v3.1
8.8
Alta
| Vetor | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Dell EMC NetWorker versions 9.0 through 9.1.1.8
Dell EMC NetWorker versions 9.1.1.9 through 9.2.1.3
Dell EMC NetWorker version 18.1.0.1
Description
The issue is related to the implementation of the Advanced Message Queuing Protocol (AMQP) in the Rabbit MQ component, where user credentials are sent unencrypted over the network. This could allow an unauthenticated attacker in the same network collision domain to potentially sniff the password and use it to access the component with the compromised user's privileges. The vulnerability is associated with the transmission of critical information in clear text, which may allow a remote attacker to elevate their privileges.
Recommendations
For versions 9.0 through 9.1.1.8, consider disabling the AMQP component until a patch is available.
For versions 9.1.1.9 through 9.2.1.3, restrict access to the Rabbit MQ service to minimize the risk of exploitation.
For version 18.1.0.1, avoid using the affected Rabbit MQ component until the issue is resolved.
Correção
Insufficiently Protected Credentials
Cleartext Transmission of Sensitive Information
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Dell Emc Networker
Rabbitmq