CVE-2018-11050

Name of the Vulnerable Software and Affected Versions Dell EMC NetWorker versions 9.0 through 9.1.1.8 Dell EMC NetWorker versions 9.1.1.9 through 9.2.1.3 Dell EMC NetWorker version 18.1.0.1

Description The issue is related to the implementation of the Advanced Message Queuing Protocol (AMQP) in the Rabbit MQ component, where user credentials are sent unencrypted over the network. This could allow an unauthenticated attacker in the same network collision domain to potentially sniff the password and use it to access the component with the compromised user's privileges. The vulnerability is associated with the transmission of critical information in clear text, which may allow a remote attacker to elevate their privileges.

Recommendations For versions 9.0 through 9.1.1.8, consider disabling the AMQP component until a patch is available. For versions 9.1.1.9 through 9.2.1.3, restrict access to the Rabbit MQ service to minimize the risk of exploitation. For version 18.1.0.1, avoid using the affected Rabbit MQ component until the issue is resolved.