PT-2018-15355 · Safe · Fme Server

Published 2018-12-23 · Updated 2019-10-03 · CVE-2018-20402

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Safe Software FME Server versions prior to 2018.1

Description The issue allows unauthorized access by creating and enabling three additional accounts with default passwords. The accounts have usernames that are the same as their passwords: guest, user, and author. These accounts are granted default privilege roles, which can be exploited by logging in with these credentials.

Recommendations For Safe Software FME Server versions prior to 2018.1, change the default passwords of the guest, user, and author accounts to secure passwords to prevent unauthorized access. Consider disabling these accounts if they are not necessary for the system's operation.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2018-20402

Affected Products

Fme Server

References · 3

• http://docs.safe.com/fme/html/FME_Server_Documentation/Content/AdminGuide/Default_User_Accounts_and_Passwords.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20402 · Security Note
• https://osv.dev/vulnerability/CVE-2018-20402 · Vendor Advisory