CVE-2017-8011 - Vulnerability Details - OpenCVE

EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R (Watch4Net) for SAS Solution Packs all versions) contain undocumented accounts with default passwords for Webservice Gateway and RMI JMX components. A remote attacker with the knowledge of the default password may potentially use these accounts to run arbitrary web service and remote procedure calls on the affected system.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Dell	Emc M\&r Emc Storage Monitoring And Reporting Emc Vipr Srm Emc Vnx Monitoring And Reporting

Configuration 1 [-]

OR	cpe:2.3:a:dell:emc_m\&r:-:::::::*
	cpe:2.3:a:dell:emc_storage_monitoring_and_reporting:4.0.2:::::::*
	cpe:2.3:a:dell:emc_vipr_srm::::::::
	cpe:2.3:a:dell:emc_vnx_monitoring_and_reporting:-:::::::*

No data.

References

Link	Providers
http://seclists.org/fulldisclosure/2017/Jul/21
http://www.securityfocus.com/bid/99555
http://www.securitytracker.com/id/1038905

History

No history.

MITRE

Status: PUBLISHED

Assigner: dell

Published: 2017-07-17T14:00:00

Updated: 2024-08-05T16:19:29.762Z

Reserved: 2017-04-21T00:00:00

Link: CVE-2017-8011

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2017-07-17T14:29:01.250

Modified: 2025-04-20T01:37:25.860

Link: CVE-2017-8011

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R (Watch4Net)", "vendor": "n/a", "versions": [{"status": "affected", "version": "EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R (Watch4Net)"}]}], "datePublic": "2017-07-17T00:00:00", "descriptions": [{"lang": "en", "value": "EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R (Watch4Net) for SAS Solution Packs all versions) contain undocumented accounts with default passwords for Webservice Gateway and RMI JMX components. A remote attacker with the knowledge of the default password may potentially use these accounts to run arbitrary web service and remote procedure calls on the affected system."}], "problemTypes": [{"descriptions": [{"description": "undocumented accounts vulnerability", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-18T09:57:01", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"name": "1038905", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1038905"}, {"name": "99555", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/99555"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://seclists.org/fulldisclosure/2017/Jul/21"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security_alert@emc.com", "ID": "CVE-2017-8011", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R (Watch4Net)", "version": {"version_data": [{"version_value": "EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R (Watch4Net)"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R (Watch4Net) for SAS Solution Packs all versions) contain undocumented accounts with default passwords for Webservice Gateway and RMI JMX components. A remote attacker with the knowledge of the default password may potentially use these accounts to run arbitrary web service and remote procedure calls on the affected system."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "undocumented accounts vulnerability"}]}]}, "references": {"reference_data": [{"name": "1038905", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1038905"}, {"name": "99555", "refsource": "BID", "url": "http://www.securityfocus.com/bid/99555"}, {"name": "http://seclists.org/fulldisclosure/2017/Jul/21", "refsource": "CONFIRM", "url": "http://seclists.org/fulldisclosure/2017/Jul/21"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T16:19:29.762Z"}, "title": "CVE Program Container", "references": [{"name": "1038905", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1038905"}, {"name": "99555", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/99555"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2017/Jul/21"}]}]}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2017-8011", "datePublished": "2017-07-17T14:00:00", "dateReserved": "2017-04-21T00:00:00", "dateUpdated": "2024-08-05T16:19:29.762Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:emc_m\\&r:-:*:*:*:*:*:*:*", "matchCriteriaId": "53A85D4E-3852-4638-9CD0-EBA9544B950F", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:emc_storage_monitoring_and_reporting:4.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "D171B347-D3A0-4067-B92F-60FE4DC64F3E", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:emc_vipr_srm:*:*:*:*:*:*:*:*", "matchCriteriaId": "15CDF8E3-4681-48E5-A0D3-CF40E301D23C", "versionEndIncluding": "4.0.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:emc_vnx_monitoring_and_reporting:-:*:*:*:*:*:*:*", "matchCriteriaId": "AE16D5AE-ABC8-4210-A54C-67F2162F64E7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R (Watch4Net) for SAS Solution Packs all versions) contain undocumented accounts with default passwords for Webservice Gateway and RMI JMX components. A remote attacker with the knowledge of the default password may potentially use these accounts to run arbitrary web service and remote procedure calls on the affected system."}, {"lang": "es", "value": "EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R para SAS Solution Packs (EMC ViPR SRM anterior a versi\u00f3n 4.1, EMC Storage M&R anterior a versi\u00f3n 4.1, EMC VNX M&R todas las versiones, EMC M&R (Watch4Net) para todas las versiones de SAS Solution Packs), contienen cuentas no documentadas con contrase\u00f1as por defecto para los componentes WebService Gateway y RMI JMX. Un atacante remoto con conocimiento de la contrase\u00f1a por defecto puede usar estas cuentas para ejecutar servicios web arbitrarios y llamadas a procedimientos remotos sobre el sistema afectado."}], "id": "CVE-2017-8011", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-07-17T14:29:01.250", "references": [{"source": "security_alert@emc.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2017/Jul/21"}, {"source": "security_alert@emc.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99555"}, {"source": "security_alert@emc.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1038905"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2017/Jul/21"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99555"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1038905"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}]}