Medium severity · published Sep 20, 2018
CVE-2018-6501
Potential security vulnerability of Insufficient Access Controls has been identified in ArcSight Management Center (ArcMC) for versions prior to 2.81
6.5
CVSS
0.8%
EPSS
No
On KEV
Description
Potential security vulnerability of Insufficient Access Controls has been identified in ArcSight Management Center (ArcMC) for versions prior to 2.81. This vulnerability could be exploited to allow for insufficient access controls.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Arcsight Management Center · HP
before 2.81 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-6501
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-6501
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03245142
More from Arcsight Management Center
7.5
CVE-2018-6505
A potential Unauthenticated File Download vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81
7.5
CVE-2018-6500
A potential Directory Traversal Security vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81
6.5
CVE-2018-6503
A potential Access Control vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81
6.1
CVE-2019-3486
Mitigates a stored cross site scripting issue in ArcSight Security Management Center versions prior to 2.9.1
6.1
CVE-2018-6502
A potential Reflected Cross-Site Scripting (XSS) Security vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81