CVE-2018-16791

In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores user passwords in an insecure manner, allowing an attacker to determine passwords for potentially privileged accounts. This also grants the attacker an ability to backdoor the server.

CVSS v3 9.8 CRITICAL
CVSS v2.0 5.0 MEDIUM

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://seclists.org/fulldisclosure/2018/Dec/0	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:solarwinds:sftp\/scp_server:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-12-05 22:29

Updated : 2023-12-10 12:44

NVD link : CVE-2018-16791

Mitre link : CVE-2018-16791

CVE.ORG link : CVE-2018-16791

JSON object : View

Products Affected

solarwinds

sftp\/scp_server

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2018-16791", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2018-12-05T22:29:00.227", "references": [{"url": "https://seclists.org/fulldisclosure/2018/Dec/0", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores user passwords in an insecure manner, allowing an attacker to determine passwords for potentially privileged accounts. This also grants the attacker an ability to backdoor the server."}, {"lang": "es", "value": "En SolarWinds SFTP/SCP Server hasta el 10/09/2018, el archivo de configuraci\u00f3n puede ser le\u00eddo y escrito por cualquier usuario y almacena las contrase\u00f1as de los usuarios de forma insegura, lo que permite que un atacante determine contrase\u00f1as para las cuentas potencialmente privilegiadas. Esto tambi\u00e9n otorga al atacante la capacidad de entrar en el servidor mediante una puerta trasera."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:solarwinds:sftp\\/scp_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17F710E8-A86C-4E81-9E41-FF3A28FC107D", "versionEndIncluding": "20180910"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}