PT-2020-19456 · Hewlett Packard · Hpe Ezmeral Container Platform+1

Published 2020-10-26 · Updated 2021-07-21 · CVE-2020-7196

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HPE BlueData EPIC Software Platform version 4.0 HPE Ezmeral Container Platform version 5.0

Description The issue concerns an insecure method of handling sensitive Kerberos passwords, making them susceptible to unauthorized interception and/or retrieval. Specifically, the kdc admin password is displayed in the source file of the API endpoint "/bdswebui/assignusers/".

Recommendations For HPE BlueData EPIC Software Platform version 4.0, consider restricting access to the "/bdswebui/assignusers/" API endpoint to minimize the risk of exploitation. For HPE Ezmeral Container Platform version 5.0, avoid using the kdc admin password in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Insufficiently Protected Credentials

Weakness Enumeration

CWE-200

CWE-522

Related Identifiers

CVE-2020-7196

Affected Products

Hpe Bluedata Epic Software Platform

Hpe Ezmeral Container Platform

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-7196 · Security Note
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04049en_us · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7196 · Vendor Advisory
• https://t.me/cibsecurity/15583 · Telegram Post