CVE-2018-10286 The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and the PostgreSQL database credentials to logged-in users via the responses to certai...
HighCVSS 8.8
EPSS 6.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and the PostgreSQL database credentials to logged-in users via the responses to certain HTTP POST requests. In order to be able to see the credentials in cleartext, an attacker needs to be authenticated.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ericssonlg ipecs nms | = a.1ac | No fix listed |
References
- gist.github.com third-party-advisory
- 44515 exploit third-party-advisory vdb-entry