Vulnerability in Avamar Virtual Edition 6.0
CVE-2014-4624
EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call.
EPSS: 0.033 (87.4th percentile) — read the EPSS interpretation.
Affected products
Weakness classification (CWE)
References
- security_alert@emc.com (vdb-entry, x_refsource_SECTRACK)
- security_alert@emc.com (x_refsource_SECUNIA, third-party-advisory)
- security_alert@emc.com (x_refsource_SECUNIA, third-party-advisory)
- security_alert@emc.com (x_refsource_MISC)
- security_alert@emc.com (vdb-entry, x_refsource_SECTRACK)
- security_alert@emc.com (vdb-entry, x_refsource_BID)
- security_alert@emc.com (x_refsource_CONFIRM)
- security_alert@emc.com (mailing-list, x_refsource_BUGTRAQ)
- security_alert@emc.com (vdb-entry, x_refsource_XF)
- security_alert@emc.com (x_refsource_MISC)