Vulnerability CVE-2014-5504
Published: 2014-09-04

Description:
SolarWinds Log and Event Manager before 6.0 uses "static" credentials, which makes it easier for remote attackers to obtain access to the database and execute arbitrary code via unspecified vectors, related to HyperSQL.

Type:

CWE-255

 (Credentials Management)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Solarwinds -> Log and event manager 

 References:
http://www.zerodayinitiative.com/advisories/ZDI-14-303/
http://www.solarwinds.com/documentation/lem/docs/releasenotes/releasenotes.htm
Copyright 2024, cxsecurity.com

 

Back to Top