CVE-2012-4933: High severity Novell ZENworks Asset Management vulnerability
The rtrlet web application in the Web Console in Novell ZENworks Asset Management (ZAM) 7.5 uses a hard-coded username of Ivanhoe and a hard-coded password of Scott for the (1) GetFilePassword and (2) GetConfigInfoPassword operations, which allows remote attackers to obtain sensitive information via a crafted rtrlet/rtr request for the HandleMaintenanceCalls function.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4933?
CVE-2012-4933 is considered a critical vulnerability due to its use of hard-coded credentials in Novell ZENworks Asset Management.
What are the implications of exploiting CVE-2012-4933?
Exploiting CVE-2012-4933 allows remote attackers to gain unauthorized access to sensitive information and potentially compromise the system.
How do I fix CVE-2012-4933?
To fix CVE-2012-4933, remove the hard-coded credentials and implement secure authentication methods in the web application.
Which versions of software are affected by CVE-2012-4933?
CVE-2012-4933 affects Novell ZENworks Asset Management version 7.5.
Can CVE-2012-4933 be mitigated without an update?
While updating is the best solution, temporary mitigation of CVE-2012-4933 can involve disabling the exposed operations or implementing strict access controls.