CVE-2014-5504 - SolarWinds Log and Event Manager before 6.0 uses "static" credentials, which makes it easier for rem

CVE-2014-5504

Summary

SolarWinds Log and Event Manager before 6.0 uses "static" credentials, which makes it easier for remote attackers to obtain access to the database and execute arbitrary code via unspecified vectors, related to HyperSQL.

References

Vulnerable Configurations

cpe:2.3:a:solarwinds:log_and_event_manager:5.2.0:*:*:*:*:*:*:*
cpe:2.3:a:solarwinds:log_and_event_manager:5.2.0:*:*:*:*:*:*:*
cpe:2.3:a:solarwinds:log_and_event_manager:5.4.0:*:*:*:*:*:*:*
cpe:2.3:a:solarwinds:log_and_event_manager:5.4.0:*:*:*:*:*:*:*
cpe:2.3:a:solarwinds:log_and_event_manager:5.5.0:*:*:*:*:*:*:*
cpe:2.3:a:solarwinds:log_and_event_manager:5.5.0:*:*:*:*:*:*:*
cpe:2.3:a:solarwinds:log_and_event_manager:5.6.0:*:*:*:*:*:*:*
cpe:2.3:a:solarwinds:log_and_event_manager:5.6.0:*:*:*:*:*:*:*
cpe:2.3:a:solarwinds:log_and_event_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:solarwinds:log_and_event_manager:*:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 08-09-2014 - 17:00)
Impact:
Exploitability:

CWE

CWE-255

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

confirm	http://www.solarwinds.com/documentation/lem/docs/releasenotes/releasenotes.htm
misc	http://www.zerodayinitiative.com/advisories/ZDI-14-303/

Last major update

08-09-2014 - 17:00

Published

04-09-2014 - 17:55

Last modified

08-09-2014 - 17:00