PT-2021-17450 · Unknown+1 · Wise-Paas/Rmm+1

Chizuru Toyama · Published 2021-05-07 · Updated 2021-05-19 · CVE-2021-27437

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions WISE-PaaS/RMM versions prior to 9.0.1

Description The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains a hard-coded administrator username and password that can be used to query Grafana APIs. Authentication is not required for exploitation.

Recommendations For versions prior to 9.0.1, update to version 9.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Grafana APIs to minimize the risk of exploitation. Avoid using the hard-coded administrator username and password until the issue is resolved.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2021-27437

Affected Products

Grafana

Wise-Paas/Rmm

References · 5

• https://osv.dev/vulnerability/CVE-2021-27437 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27437 · Security Note
• https://t.me/cvenotify/14259 · Telegram Post
• https://t.me/cvenotify/14692 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-21-124-01 · Note