CVE-2018-10286

The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and the PostgreSQL database credentials to logged-in users via the responses to certain HTTP POST requests. In order to be able to see the credentials in cleartext, an attacker needs to be authenticated.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2018-04-22

Last modified

2024-08-05

Weaknesses

CWE-522

Affected products

• Ipecs Nms (Ericssonlg)

References

• https://gist.github.com/berkgoksel/fde102503c457c0344e2e53b7971437a
• https://www.exploit-db.com/exploits/44515/