CVE-2018-7111 Missing authorization in HPE UIoT
Remote attackers can modify information in the HPE UIoT DSM portal and APIs due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-7111?
CVE-2018-7111 is a medium-severity missing authorization vulnerability in Hewlett Packard Enterprise HPE UIoT, published on 17 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A remote unauthorized access vulnerability was identified in HPE UIoT versions 1.5, 1.4.0, 1.4.1, 1.4.2, 1.2.4.2. Specifically, there is a malfunction identified in some section of the DSM portal and some DSM APIs. The impact of the malfunction is that the info can be changed by other users.
Which versions are affected by CVE-2018-7111?
It affects 1 product.
Products include Hp Universal Internet of Things.
How do I fix CVE-2018-7111?
No fix has been published for CVE-2018-7111 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-7111 being exploited?
There is no known exploitation of CVE-2018-7111 in the wild and no public exploit code.
Other vulnerabilities in Hewlett Packard Enterprise HPE UIoT
Sources
Also known as GHSA-pjjm-fc8r-wg53.