title: Hashed Credential Exposure Vulnerability
description: An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service (SWIS). Exposed credentials are encrypted and require authenticated access with an NCM role.
problem types: CWE-326 Inadequate Encryption Strength
affected:
{
defaultStatus: unaffected
product: Network Configuration Manager
vendor: SolarWinds
versions:
lessThan: 2020.2.5, status: affected, version: 2020.2.5 and previous version, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: SolarWinds recommends customers upgrade to the latest version once it becomes generally available.