CVE-2023-2291

HIGH Year: 2023
CVSS v3 Score
7.8
High
Weakness Type
CWE-798
View all →

Vulnerability Description

Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permissions from that of a low-privileged user to an Administrative user.

Related Vulnerabilities

CVE-2006-7142

HIGH
CVSS:7.8(High)

The centralized management feature for Utimaco Safeguard stores hard-coded cryptographic keys in executable programs for encrypted configuration files, which allows attackers to recover the keys from ...

CWE-7982006

CVE-2010-2772

HIGH
CVSS:7.8(High)

Siemens Simatic WinCC and PCS 7 SCADA system uses a hard-coded password, which allows local users to access a back-end database and gain privileges, as demonstrated in the wild in July 2010 by the Stu...

CWE-7982010

CVE-2016-2948

HIGH
CVSS:7.8(High)

IBM BigFix Remote Control before 9.1.3 allows local users to discover hardcoded credentials via unspecified vectors.

CWE-7982016

CVE-2017-11026

HIGH
CVSS:7.8(High)

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing FRP partition using reference FRP unlock, authentication method can be co...

CWE-7982017

CVE-2017-14376

HIGH
CVSS:7.8(High)

EMC AppSync Server prior to 3.5.0.1 contains database accounts with hardcoded passwords that could potentially be exploited by malicious users to compromise the affected system.

CWE-7982017

CVE-2017-14426

HIGH
CVSS:7.8(High)

D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0644 /var/etc/shadow (aka the /etc/shadow symlink target) permissions.

CWE-7982017