Vulnerability Description
The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and the PostgreSQL database credentials to logged-in users via the responses to certain HTTP POST requests. In order to be able to see the credentials in cleartext, an attacker needs to be authenticated.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ericssonlg | Ipecs Nms | a.1ac |
Related Weaknesses (CWE)
References
- https://gist.github.com/berkgoksel/fde102503c457c0344e2e53b7971437aThird Party Advisory
- https://www.exploit-db.com/exploits/44515/Third Party AdvisoryVDB Entry
- https://gist.github.com/berkgoksel/fde102503c457c0344e2e53b7971437aThird Party Advisory
- https://www.exploit-db.com/exploits/44515/Third Party AdvisoryVDB Entry
FAQ
What is CVE-2018-10286?
CVE-2018-10286 is a vulnerability with a CVSS score of 8.8 (HIGH). The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and the PostgreSQL database credentials to logged-in users via the responses to certai...
How severe is CVE-2018-10286?
CVE-2018-10286 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-10286?
Check the references section above for vendor advisories and patch information. Affected products include: Ericssonlg Ipecs Nms.