Skip to main content

Avamar CVE-2014-4623

MEDIUM
Cryptographic Issues (CWE-310)
2014-10-25 security_alert@emc.com
Information Disclosure Avamar
4.3
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:N/A:N
Attack Vector
Network
Attack Complexity
M
Confidentiality
P
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Oct 25, 2014 - 10:55 cve.org
MEDIUM 4.3

DescriptionCVE.org

EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.

AnalysisAI

EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-310. EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack. Affected products include: Emc Avamar. Version information: before 2.0.0.4.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Avamar

View all
CVE-2013-0945 CRITICAL
9.3 May 03

EMC Avamar Client before 6.1.101-89 does not verify that the server hostname matches a domain name in the subject's Comm
CVE-2016-0906 HIGH
8.8 Jul 06

The web-restore interface in Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar through 7.1.2 and 7.
CVE-2012-2291 HIGH
7.2 Jan 21

EMC Avamar Client 4.x, 5.x, and 6.x on HP-UX and Mac OS X, and the EMC Avamar plugin 4.x, 5.x, and 6.x for Oracle, uses

CVE-2013-0944 LOW
3.5 May 03

The web-based file-restore interface in EMC Avamar Server before 6.1.0 allows remote authenticated users to read arbitra
CVE-2012-4610 LOW
3.3 Oct 31

EMC Avamar Client for VMware 6.1 stores the cleartext server root password on the proxy client, which might allow remote
CVE-2025-21120 HIGH
8.3 Aug 04

Dell Avamar, versions prior to 19.10 SP1 with patch 338904, contains a Trusting HTTP Permission Methods on the Server-Si

Same weakness CWE-310 – Cryptographic Issues

View all
CVE-2015-0204 MEDIUM POC
4.3
CVE-2015-4000 LOW POC
3.7
CVE-2014-3566 LOW POC
3.4
CVE-2014-8684 CRITICAL POC
9.8
CVE-2012-1803 HIGH POC
8.5
CVE-2013-4787 CRITICAL POC
9.3
CVE-2014-8686 CRITICAL POC
9.8
CVE-2013-0137 CRITICAL
10.0

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2014-4623 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy