1. CVE-Search
  2. CVE-2020-5805
ID CVE-2020-5805
Summary In Marvell QConvergeConsole GUI <= 5.5.0.74, credentials are stored in cleartext in tomcat-users.xml. OS-level users on the QCC host who are not authorized to use QCC may use the plaintext credentials to login to QCC.
References
Vulnerable Configurations
  • cpe:2.3:a:marvell:qconvergeconslole_gui:-:*:*:*:*:*:*:*
    cpe:2.3:a:marvell:qconvergeconslole_gui:-:*:*:*:*:*:*:*
  • cpe:2.3:a:marvell:qconvergeconslole_gui:5.5.0.74:*:*:*:*:*:*:*
    cpe:2.3:a:marvell:qconvergeconslole_gui:5.5.0.74:*:*:*:*:*:*:*
CVSS
Base: 9.0 (as of 14-01-2021 - 17:21)
Impact:
Exploitability:
CWE CWE-312
CAPEC
  • Retrieve Embedded Sensitive Data
    An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:S/C:C/I:C/A:C
refmap via4
misc https://www.tenable.com/security/research/tra-2021-01
Last major update 14-01-2021 - 17:21
Published 08-01-2021 - 16:15
Last modified 14-01-2021 - 17:21
Back to Top