PT-2019-17143 · Ibm · Ibm Datapower Gateway

Publicado 2019-12-09 · Atualizado 2019-12-17 · CVE-2019-4621

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 6.0.0 through 6.0.14 IBM DataPower Gateway versions 7.6.0.0 through 7.6.0 (no end version specified, assuming up to but not including the next major release) IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.5

Description The issue concerns a default administrator account that is enabled when the IPMI LAN channel is enabled, allowing a remote attacker to gain unauthorized access to the BMC.

Recommendations For IBM DataPower Gateway versions 6.0.0 through 6.0.14, disable the default administrator account or restrict access to the IPMI LAN channel. For IBM DataPower Gateway versions 7.6.0.0, disable the default administrator account or restrict access to the IPMI LAN channel. For IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.5, disable the default administrator account or restrict access to the IPMI LAN channel.

Correção

Enumeração de Fraquezas

CWE-1188

Identificadores relacionados

CVE-2019-4621

Produtos afetados

Ibm Datapower Gateway

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-4621 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/168883 · Aviso do Fabricante
• https://ibm.com/support/pages/node/1125615 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-4621 · Nota de Segurança