CVE-2017-8011in critical feed
EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VN…
Published 9 y ago · modified 4 mo ago · JSON
Summary
EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R (Watch4Net) for SAS Solution Packs all versions) contain undocumented accounts with default passwords for Webservice Gateway and RMI JMX components. A remote attacker with the knowledge of the default password may potentially use these accounts to run arbitrary web service and remote procedure calls on the affected system.
Exploit prediction (EPSS)
14.02% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- n/a EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R (Watch4Net)
Classification
- Weakness
- CWE-798 Use of Hard-coded Credentials
References
- securitytracker.com /id/1038905 · vdb-entry, x_refsource_SECTRACK, x_transferred
- securityfocus.com /bid/99555 · vdb-entry, x_refsource_BID, x_transferred
- seclists.org /fulldisclosure/2017/Jul/21 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-8011
- NVD: CVE-2017-8011
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.