CVE-2018-15768: vulnerability in Dell OpenManage Network Manager
Insecure MySQL Configuration Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. It has a public proof of concept.
Dell OpenManage Network Manager versions before 6.5.0 had an insecure MySQL setup that allowed database users to read and write files on the server. This could let attackers access sensitive data or modify system files.
The vulnerability stems from insecure default MySQL configuration in embedded database instances, granting FILE privilege to database users without restriction. An attacker with database access can leverage INTO OUTFILE/LOAD_FILE functionality to exfiltrate sensitive files or inject malicious content into the filesystem, potentially leading to privilege escalation or code execution depending on file permissions.
In the same product, most dangerous first.