Lucene search

HackeroneCVE-2018-16498

HistoryMay 26, 2021 - 7:15 p.m.

CVE-2018-16498

2021-05-2619:15:08

CWE-312

hackerone

web.nvd.nist.gov

cve-2018-16498

versa director

unencrypted backup

credentials

configuration files

snmp

ssl

trust keystores

nvd

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

Percentile

12.6%

JSON

In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within configuration files. These credentials are for various application components such as SNMP, and SSL and Trust keystores.

Affected configurations

Nvd

Vulners

Node

versa-networksversa_directorMatch-

VendorProductVersionCPE
versa-networksversa_director-cpe:2.3:a:versa-networks:versa_director:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
versa-networks	versa_director	-	cpe:2.3:a:versa-networks:versa_director:-:::::::*

CNA Affected

[
  {
    "product": "Versa Director",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed Versions: 16.1R2S11, 20.2.2, 21.1.1, 21.2.1"
      }
    ]
  }
]

References

hackerone.com/reports/1168195

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2018-16498