CVE-2023-28503
Assigner: rapid7
Published: 2023-03-29T20:09:43.764Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: Linux
product: UniData
vendor: Rocket Software
versions: lessThan: 8.2.43.3003
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
platforms: Linux
product: UniVerse
vendor: Rocket Software
versions: lessThan: 11.3.5.1001
status: affected
version: 0
versionType: semver
lessThan: 12.2.1.2002
status: affected
version: 0
versionType: semver
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Ron Bowes
datePublic: 2023-03-29T16:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to bypass authentication checks and execute OS commands as the root user.
value: Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to bypass authentication checks and execute OS commands as the root user.
problemTypes: descriptions: cweId: CWE-798
description: CWE-798 Use of Hard-coded Credentials
type: CWE
source: discovery: UNKNOWN
title: Authentication bypass in UniRPC's udadmin service
x_generator: engine: Vulnogram 0.1.0-dev