CVE-2019-13657 - OpenCVE

CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:S/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Broadcom	Ca Performance Management Network Operations

Configuration 1 [-]

OR	cpe:2.3:a:broadcom:ca_performance_management::::::::
	cpe:2.3:a:broadcom:ca_performance_management::::::::
	cpe:2.3:a:broadcom:ca_performance_management:3.5.0:::::::*

Configuration 2 [-]

cpe:2.3:a:broadcom:network_operations:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://packetstormsecurity.com/files/154904/CA-Performance-Management-Arbitary-Command-Execution.html
http://packetstormsecurity.com/files/154904/CA-Performance-Management-Arbitrary-Command-Execution.html
http://seclists.org/fulldisclosure/2019/Oct/37
https://seclists.org/bugtraq/2019/Oct/26
https://techdocs.broadcom.com/us/product-content/recommended-reading/security-notices/ca-20191015-01-security-notice-for-ca-performance-management.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: ca

Published: 2019-10-17T18:45:16.512931Z

Updated: 2024-09-17T02:31:44.581Z

Reserved: 2019-07-18T00:00:00

Link: CVE-2019-13657

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2019-10-17T19:15:10.547

Modified: 2019-10-24T13:58:40.490

Link: CVE-2019-13657

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "CA Performance Management", "vendor": "CA Technologies, A Broadcom Company", "versions": [{"status": "affected", "version": "3.5.x"}, {"status": "affected", "version": "3.6.x before 3.6.9"}, {"status": "affected", "version": "3.7.x before 3.7.4"}]}], "datePublic": "2019-10-15T00:00:00", "descriptions": [{"lang": "en", "value": "CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-10-18T18:06:13", "orgId": "e291eae9-7c0a-46ac-ba7d-5251811f8b7f", "shortName": "ca"}, "references": [{"name": "20191017 CA20191015-01: Security Notice for CA Performance Management", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "https://seclists.org/bugtraq/2019/Oct/26"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/154904/CA-Performance-Management-Arbitary-Command-Execution.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://techdocs.broadcom.com/us/product-content/recommended-reading/security-notices/ca-20191015-01-security-notice-for-ca-performance-management.html"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/154904/CA-Performance-Management-Arbitrary-Command-Execution.html"}, {"name": "20191018 CA20191015-01: Security Notice for CA Performance Management", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2019/Oct/37"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.0.8"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "vuln@ca.com", "DATE_PUBLIC": "2019-10-15T04:00:00.000Z", "ID": "CVE-2019-13657", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "CA Performance Management", "version": {"version_data": [{"version_value": "3.5.x"}, {"version_value": "3.6.x before 3.6.9"}, {"version_value": "3.7.x before 3.7.4"}]}}]}, "vendor_name": "CA Technologies, A Broadcom Company"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security."}]}, "generator": {"engine": "Vulnogram 0.0.8"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-798 Use of Hard-coded Credentials"}]}]}, "references": {"reference_data": [{"name": "20191017 CA20191015-01: Security Notice for CA Performance Management", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/Oct/26"}, {"name": "http://packetstormsecurity.com/files/154904/CA-Performance-Management-Arbitary-Command-Execution.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/154904/CA-Performance-Management-Arbitary-Command-Execution.html"}, {"name": "https://techdocs.broadcom.com/us/product-content/recommended-reading/security-notices/ca-20191015-01-security-notice-for-ca-performance-management.html", "refsource": "CONFIRM", "url": "https://techdocs.broadcom.com/us/product-content/recommended-reading/security-notices/ca-20191015-01-security-notice-for-ca-performance-management.html"}, {"name": "http://packetstormsecurity.com/files/154904/CA-Performance-Management-Arbitrary-Command-Execution.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/154904/CA-Performance-Management-Arbitrary-Command-Execution.html"}, {"name": "20191018 CA20191015-01: Security Notice for CA Performance Management", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2019/Oct/37"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T23:57:39.578Z"}, "title": "CVE Program Container", "references": [{"name": "20191017 CA20191015-01: Security Notice for CA Performance Management", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "https://seclists.org/bugtraq/2019/Oct/26"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/154904/CA-Performance-Management-Arbitary-Command-Execution.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://techdocs.broadcom.com/us/product-content/recommended-reading/security-notices/ca-20191015-01-security-notice-for-ca-performance-management.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/154904/CA-Performance-Management-Arbitrary-Command-Execution.html"}, {"name": "20191018 CA20191015-01: Security Notice for CA Performance Management", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2019/Oct/37"}]}]}, "cveMetadata": {"assignerOrgId": "e291eae9-7c0a-46ac-ba7d-5251811f8b7f", "assignerShortName": "ca", "cveId": "CVE-2019-13657", "datePublished": "2019-10-17T18:45:16.512931Z", "dateReserved": "2019-07-18T00:00:00", "dateUpdated": "2024-09-17T02:31:44.581Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:broadcom:ca_performance_management:*:*:*:*:*:*:*:*", "matchCriteriaId": "555A2392-E768-46F0-BE49-CF005161CDEE", "versionEndExcluding": "3.6.9", "versionStartIncluding": "3.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:broadcom:ca_performance_management:*:*:*:*:*:*:*:*", "matchCriteriaId": "CBC72C6D-3EFA-4DBF-A3C9-901920D600F7", "versionEndExcluding": "3.7.4", "versionStartIncluding": "3.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:broadcom:ca_performance_management:3.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "24815510-52EB-4759-9E70-AEED9D82E662", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:broadcom:network_operations:*:*:*:*:*:*:*:*", "matchCriteriaId": "A49DF530-1EF0-4F48-81FE-63AA669518A8", "versionEndIncluding": "19.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security."}, {"lang": "es", "value": "CA Performance Management versiones 3.5.x, versiones 3.6.x anteriores a 3.6.9 y versiones 3.7.x anteriores a 3.7.4, presenta una vulnerabilidad de credencial predeterminada que puede permitir a un atacante remoto ejecutar comandos arbitrarios y comprometer la seguridad del sistema."}], "id": "CVE-2019-13657", "lastModified": "2019-10-24T13:58:40.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "vuln@ca.com", "type": "Secondary"}]}, "published": "2019-10-17T19:15:10.547", "references": [{"source": "vuln@ca.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/154904/CA-Performance-Management-Arbitary-Command-Execution.html"}, {"source": "vuln@ca.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/154904/CA-Performance-Management-Arbitrary-Command-Execution.html"}, {"source": "vuln@ca.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2019/Oct/37"}, {"source": "vuln@ca.com", "tags": ["Issue Tracking", "Mailing List", "Third Party Advisory"], "url": "https://seclists.org/bugtraq/2019/Oct/26"}, {"source": "vuln@ca.com", "tags": ["Vendor Advisory"], "url": "https://techdocs.broadcom.com/us/product-content/recommended-reading/security-notices/ca-20191015-01-security-notice-for-ca-performance-management.html"}], "sourceIdentifier": "vuln@ca.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-798"}], "source": "vuln@ca.com", "type": "Secondary"}]}