Vulnerability identifier: #VU17789

Vulnerability risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0102

CWE-ID: CWE-287

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
Data Center Manager SDK
Client/Desktop applications / File managers, FTP clients

Vendor: Intel

Description
The vulnerability allows an adjacent unauthenticated attacker to gain elevated privileges on the target system.

The weakness exists due to insufficient session authentication in web server for Intel(R) Data Center Manager SDK. An adjacent attacker can gain elevated privileges.

Mitigation
Update to version 5.0.2.

Vulnerable software versions

Data Center Manager SDK: 5.0.0 - 5.0.1

---

External links
http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00215.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.