CVE-2018-13821 Missing authorization in Unified Infrastructure Management
Remote attackers can read and write files due to missing authentication in CA Unified Infrastructure Management.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-13821?
CVE-2018-13821 is a critical missing authorization vulnerability in CA Technologies Unified Infrastructure Management, published on 30 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A lack of authentication, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows remote attackers to conduct a variety of attacks, including file reading/writing.
Weakness: CWE-287
Which versions are affected by CVE-2018-13821?
It affects 1 product.
Products include Ca Unified Infrastructure Management.
How do I fix CVE-2018-13821?
No fix has been published for CVE-2018-13821 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-13821 being exploited?
There is no known exploitation of CVE-2018-13821 in the wild and no public exploit code.
Other vulnerabilities in CA Technologies Unified Infrastructure Management
Sources
Also known as GHSA-gxpj-x43j-q24c.