Versa Networks Versa Director insecure default PostgreSQL configuration
Versa Networks Versa Director, by default, configures PostgreSQL to listen on all network interfaces using database credentials shared by multiple installations. From [Advising Vulnerability In Versa Director](https://security-portal.versa-networks.com/emailbulletins/6735a300415abb89e9a8a9d3): "This combination allows an unauthenticated attacker to access and administer the database or read local filesystem contents to escalate privileges on the system.... Starting with the latest 22.1.4 version of Versa Director, the software will automatically restrict access to the Postgres and HA ports to only the local and peer Versa Directors." The advisory does not directly address the "...common password across all instances of Versa Director."
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-42450US | —OT erhöht | — | ||
The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Versa Director. The default confi… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (1)
- BehobenVersa Networks Versa Director 0 < 22.1.4 2024-11-11 Hot Fix
From: [Advising Vulnerability In Versa Director](https://security-portal.versa-networks.com/emailbulletins/6735a300415abb89e9a8a9d3): "Starting with the latest 22.1.4 version of Versa Director, the software will automatically restrict access to the Postgres and HA ports to only the local and peer Versa Directors." The advisory does not directly address the "...common password across all instances of Versa Director."
https://security-portal.versa-networks.com/emailbulletins/6735a300415abb89e9a8a9d3
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan