PT-2019-18121 · Teradata · Teradata Viewpoint

Published 2019-01-21 · Updated 2019-02-07 · CVE-2019-6499

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Teradata Viewpoint versions prior to 14.0 Teradata Viewpoint version 16.20.00.02-b80 and earlier

Description The issue concerns a hardcoded password TDv1i2e3w4 for the viewpoint database account, which could be exploited by malicious users to compromise the system. This password is found in the server.xml file located in the viewpoint-portalconf directory.

Recommendations For Teradata Viewpoint versions prior to 14.0, update to version 14.0 or later. For Teradata Viewpoint version 16.20.00.02-b80 and earlier, update to a version later than 16.20.00.02-b80. As a temporary workaround, consider changing the hardcoded password TDv1i2e3w4 for the viewpoint database account to a secure password until a patch is available.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2019-6499

Affected Products

Teradata Viewpoint

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-6499 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6499 · Vendor Advisory
• https://github.com/inf0seq/inf0seq.github.io/blob/master/_posts/2019-01-20-Teradata%20Viewpoint%20Hardcoded%20Password%20Vulnerability.md · Note
• https://inf0seq.github.io/cve/2019/01/20/Teradata-Viewpoint-Hardcoded-Password-Vulnerability.html · Note