APP: SolarWinds Log and Event Manager Static Credentials
A policy bypass vulnerability exists in SolarWinds Log and Event Manager. A remote attacker can exploit this vulnerability to access the database with administrator privileges. Once accessed, the attacker can read and write information in the database.
Extended Description
SolarWinds Log and Event Manager before 6.0 uses "static" credentials, which makes it easier for remote attackers to obtain access to the database and execute arbitrary code via unspecified vectors, related to HyperSQL.
Affected Products
Solarwinds log_and_event_manager
References
CVE: CVE-2014-5504
Short Name
APP:SOLARWINDS-LOG-EVENT-MANAGR
Severity
Major
Recommended
False
Recommended Action
Drop
Category
APP
Keywords
CVE-2014-5504 Credentials Event Log Manager SolarWinds Static and
Release Date
09/22/2014
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3761
Port
TCP/9001
False Positive
Unknown
Vendors
Solarwinds
CVSS Score
7.5