PT-2017-16239 · Emc · Emc Esrs Policy Manager

Travis Emmert · Published 2017-07-09 · Updated 2019-10-03 · CVE-2017-4976

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EMC ESRS Policy Manager versions prior to 6.8

Description The issue concerns an undocumented account, specifically the OpenDS admin, which has a default password. This allows a remote attacker who knows the default password to log in and gain administrator privileges to the local LDAP directory server.

Recommendations For versions prior to 6.8, change the default password of the OpenDS admin account to prevent unauthorized access. As a temporary workaround, consider restricting access to the LDAP directory server until the default password is changed.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2017-4976

Affected Products

Emc Esrs Policy Manager

References · 4

• https://osv.dev/vulnerability/CVE-2017-4976 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-4976 · Security Note
• http://seclists.org/fulldisclosure/2017/Jul/13 · Note
• http://securitytracker.com/id/1038840 · Note