VULNERABILITY INTELLIGENCE

CVE-2020-7196

CVSS score6.5 MEDIUM
EPSS probability0.86%
CISA KEVNot currently listed
Published2020-10-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of handling sensitive Kerberos passwords that is susceptible to unauthorized interception and/or retrieval. Specifically, they display the kdc_admin_password in the source file of the url "/bdswebui/assignusers/".

Weakness classification

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-522: Insufficiently Protected Credentials

Primary references