CVE-2016-6650
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk73th percentile - higher than 73% of all known CVEs
Summary
An SSL Stripping vulnerability in EMC RecoverPoint versions prior to 5.0 and EMC RecoverPoint for Virtual Machines versions prior to 5.0 allows attackers to intercept and modify SSL traffic, potentially compromising the affected system.
Risk Assessment
Attackers can exploit this vulnerability to impersonate the server, intercept sensitive data, or perform man-in-the-middle attacks, threatening the integrity and confidentiality of the system.
Recommendation
Immediately upgrade EMC RecoverPoint and EMC RecoverPoint for Virtual Machines to version 5.0 or later to eliminate the SSL Stripping vulnerability.
Other vulnerabilities in EMC RecoverPoint
See all- CVE-2016-6649Medium
EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0 contain multiple command injection vulnerabilities. A malicious administrator with configuration privileges may bypass the user interface and escalate privileges to root.
- CVE-2016-6648Medium
In EMC RecoverPoint before 4.4.1.1 and EMC RecoverPoint for Virtual Machines before 5.0, a sensitive information disclosure vulnerability exists due to incorrect permissions on a system file. A malicious administrator with configuration privileges may access this file and compromise the system.
Original NVD description (English source)
EMC RecoverPoint versions prior to 5.0 and EMC RecoverPoint for Virtual Machines versions prior to 5.0 have an SSL Stripping Vulnerability that may potentially be exploited by malicious users to compromise the affected system.