What is CVE-2020-7196?

CVE-2020-7196 is a medium-severity vulnerability in HP Bluedata Epic, classified under Information Disclosure. CVSS score: 6.5/10. Published 2020-10-26.

How severe is CVE-2020-7196?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Information disclosure in HP Bluedata Epic

CVE-2020-7196

The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of handling sensitive Kerberos passwords that is susceptible to unauthorized interception and/or retrieval. Specifically, they display the kdc_admin_password in the source file of the url "/bdswebui/assignusers/".

Vulnerability class: Information Disclosure

EPSS: 0.009 (54.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Hp Bluedata_epic
Hp Ezmeral_container_platform — versions 5.0
N/a Bluedata Epic Software; Hpe Ezmeral Container Platform — versions 4.0 and earlier, 5.0

Weakness classification (CWE)

References

security-alert@hpe.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-7196?: CVE-2020-7196 is a medium-severity vulnerability in HP Bluedata Epic, classified under Information Disclosure. CVSS score: 6.5/10. Published 2020-10-26.
How severe is CVE-2020-7196?: Medium severity. CVSS v3 base score is 6.5 out of 10.