Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-5504

SolarWinds Log and Event Manager before 6.0 uses "static" credentials, which makes it easier for remote attackers to obtain access to the database and execute arbitrary code via unspecified vectors, related to HyperSQL.

Published

2014-09-04T17:55:08.467

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-255
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application solarwinds log_and_event_manager ≤ 5.7.0 Yes
Application solarwinds log_and_event_manager 5.2.0 Yes
Application solarwinds log_and_event_manager 5.4.0 Yes
Application solarwinds log_and_event_manager 5.5.0 Yes
Application solarwinds log_and_event_manager 5.6.0 Yes
References