Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-8013

EMC Data Protection Advisor 6.3.x before patch 67 and 6.4.x before patch 130 contains undocumented accounts with hard-coded passwords and various privileges. Affected accounts are: "Apollo System Test", "emc.dpa.agent.logon" and "emc.dpa.metrics.logon". An attacker with knowledge of the password could potentially use these accounts via REST APIs to gain unauthorized access to EMC Data Protection Advisor (including potentially access with administrative privileges).

Published

2018-03-16T20:29:00.350

Last Modified

2024-11-21T03:33:09.507

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

6.4

Weaknesses

Type: Primary
CWE-798

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	emc	data_protection_advisor	6.3.0	Yes
Application	emc	data_protection_advisor	6.4.0	Yes

References

http://seclists.org/fulldisclosure/2017/Sep/36 Mailing List, Third Party Advisory ([email protected])
http://www.securityfocus.com/bid/100846 Third Party Advisory, VDB Entry ([email protected])
http://www.securitytracker.com/id/1039370 Third Party Advisory, VDB Entry ([email protected])
http://seclists.org/fulldisclosure/2017/Sep/36 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/100846 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1039370 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)