CVE-2018-20402 - CVE House
Back to Database
Status published High CVE-2018-20402

Safe Software FME Server through 2018.1 creates and enables three...

Vulnerability Description

Safe Software FME Server through 2018.1 creates and enables three additional accounts in addition to the initial administrator account. The passwords to the three accounts are the same as the usernames, which are guest, user, and author. Logging in with these accounts will grant any user the default privilege roles that were also created for each of the accounts.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-20402

Credits & Attribution

No credits recorded in the NVD database.

References

More from safe

View All →
CVE-2022-38342
Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered...
High 8.5
CVE-2022-38341
Safe Software FME Server v2021.2.5 and below does not employ...
High 7.1
CVE-2022-38340
Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered...
Critical 9.1
CVE-2022-38339
Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a...
Critical 9.6
CVE-2020-22790
Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0...
Medium 5.4

Affected Vendor

Affected Software

fme server
Vulnerable Versions:
0

Timeline

Official Publish: December 23rd, 2018
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.