VulnerabilityModified
CVE-2014-5504
SolarWinds Log and Event Manager before 6.0 uses "static" credentials, which makes it easier for remote attackers to obtain access to the database and execute arbitrary code via unspecified vectors, related to HyperSQL.
HIGH 7.5EPSS 5.39%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SolarWinds Log and Event Manager before 6.0 uses "static" credentials, which makes it easier for remote attackers to obtain access to the database and execute arbitrary code via unspecified vectors, related to HyperSQL.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 5.39% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-255
- Affected
- solarwinds/log and event manager
- Source
- cve@mitre.org
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.