9.8crit
CVE-2019-83521 exploit
By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials sent over the network…
Published 7 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
6.3%
percentile 94%
Public exploits
1
Exploit-DB
Summary
By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials sent over the network to managed PATROL Agent services. If an attacker were able to capture this network traffic, they could decrypt these credentials and use them to execute code or escalate privileges on the network.
Exploit prediction (EPSS)
6.28% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.
Exploits and detections
- EDB-46969 IBM Websphere Application Server - Network Deployment Untrusted Data Deserialization Remote Code Execution (Metasploit) · remote · 2019-06-05
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-798 Use of Hard-coded Credentials
References
- securifera.com /advisories/CVE-2019-8352/ · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2019-8352
- NVD: CVE-2019-8352
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.