CVE-2018-11050 Information disclosure in Networker
An attacker can sniff unencrypted user credentials sent over the network to access the Dell EMC NetWorker AMQP component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-11050?
CVE-2018-11050 is a high-severity vulnerability in Dell EMC Networker, published on 1 Aug 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Dell EMC NetWorker versions between 9.0 and 9.1.1.8 through 9.2.1.3, and the version 18.1.0.1 contain a Clear-Text authentication over network vulnerability in the Rabbit MQ Advanced Message Queuing Protocol (AMQP) component. User credentials are sent unencrypted to the remote AMQP service. An unauthenticated attacker in the same network collision domain, could potentially sniff the password from the network and use it to access the component using the privileges of the compromised user.
Which versions are affected by CVE-2018-11050?
It affects 1 product.
Products include Dell Emc Networker.
How do I fix CVE-2018-11050?
No fix has been published for CVE-2018-11050 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-11050 being exploited?
There is no known exploitation of CVE-2018-11050 in the wild and no public exploit code.
Other vulnerabilities in Dell EMC Networker
Sources
Also known as GHSA-m47g-cvwq-8hqm.