CVE-2018-1206

Name of the Vulnerable Software and Affected Versions Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110

Description The issue concerns a hardcoded database account with administrative privileges, specifically the account apollosuperuser. An attacker with local access to the server where DPA Datastore Service is installed and knowledge of the password may potentially gain unauthorized access to the database. It is noted that the Datastore Service database cannot be accessed remotely using this account.

Recommendations For Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159, update to version 6.3 Patch 159 or later. For Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110, update to version 6.4 Patch 110 or later.