CVE-2018-7108 Auth bypass in HPE StorageWorks XP7 Automation Director (AutoDir)
Attackers can bypass authentication to expose storage system user credentials when running specific service templates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-7108?
CVE-2018-7108 is a medium-severity authentication bypass vulnerability in Hewlett Packard Enterprise HPE StorageWorks XP7 Automation Director (AutoDir), published on 27 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HPE StorageWorks XP7 Automation Director (AutoDir) version 8.5.2-02 to earlier than 8.6.1-00 has a local and remote authentication bypass vulnerability that exposed the user authentication information of the storage system. This problem sometimes occurred under specific conditions when running a service template.
Weakness: CWE-287
Which versions are affected by CVE-2018-7108?
It affects 1 product.
Products include Hpe Storageworks Xp7 Automation Director.
How do I fix CVE-2018-7108?
No fix has been published for CVE-2018-7108 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-7108 being exploited?
There is no known exploitation of CVE-2018-7108 in the wild and no public exploit code.
Sources
Also known as GHSA-p7j9-6rjw-4cw5.