CVE-2010-4094 Hardcoded credentials in n/a
Remote attackers can execute arbitrary code by using the default administrator password in the Tomcat server of IBM Rational Quality Manager.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2010-4094?
CVE-2010-4094 is a medium-severity vulnerability in Ibm Rational Quality Manager, published on 26 Oct 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Tomcat server in IBM Rational Quality Manager and Rational Test Lab Manager has a default password for the ADMIN account, which makes it easier for remote attackers to execute arbitrary code by leveraging access to the manager role. NOTE: this might overlap CVE-2009-3548.
Weakness: CWE-255
Which versions are affected by CVE-2010-4094?
It affects 2 products.
Products include Ibm Rational Quality Manager, Ibm Rational Test Lab Manager.
How do I fix CVE-2010-4094?
No fix has been published for CVE-2010-4094 yet. Limit exposure of the affected software until one is available.
Is CVE-2010-4094 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-4094 exists.
Public exploit code: 3 Metasploit modules and 1 Exploit-DB entry.
Other vulnerabilities in Ibm Rational Quality Manager
- CVE-2017-1103 XML external entity in Rational Collaborative Lifecycle Management
- CVE-2017-1738 Privilege escalation in Rational Quality Manager
- CVE-2019-4602 Cross-site scripting in Rational Quality Manager
- CVE-2018-1759 Cross-site scripting in Rational Quality Manager
- CVE-2018-1763 Cross-site scripting in Rational Quality Manager
Sources
Also known as GHSA-fqc2-x4j5-637f.