CVE-2014-5504

2014-09-0417:55:08

CWE-255

[email protected]

web.nvd.nist.gov

cve-2014-5504

solarwinds

log and event manager

vulnerability

database

arbitrary code

hypersql

7.9 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.94 High

EPSS

Percentile

99.2%

JSON

SolarWinds Log and Event Manager before 6.0 uses “static” credentials, which makes it easier for remote attackers to obtain access to the database and execute arbitrary code via unspecified vectors, related to HyperSQL.

Affected configurations

NVD

Node

solarwindslog_and_event_managerRange≤5.7.0

solarwindslog_and_event_managerMatch5.2.0

solarwindslog_and_event_managerMatch5.4.0

solarwindslog_and_event_managerMatch5.5.0

solarwindslog_and_event_managerMatch5.6.0

CPENameOperatorVersion
solarwinds:log_and_event_managersolarwinds log and event managerle5.7.0
solarwinds:log_and_event_managersolarwinds log and event managereq5.2.0
solarwinds:log_and_event_managersolarwinds log and event managereq5.4.0
solarwinds:log_and_event_managersolarwinds log and event managereq5.5.0
solarwinds:log_and_event_managersolarwinds log and event managereq5.6.0

CPE	Name	Operator	Version
solarwinds:log_and_event_manager	solarwinds log and event manager	le	5.7.0
solarwinds:log_and_event_manager	solarwinds log and event manager	eq	5.2.0
solarwinds:log_and_event_manager	solarwinds log and event manager	eq	5.4.0
solarwinds:log_and_event_manager	solarwinds log and event manager	eq	5.5.0
solarwinds:log_and_event_manager	solarwinds log and event manager	eq	5.6.0