CVE-2012-4933: novell zenworks_asset_management Credentials Management Errors
Vulnerability summary
CVE-2012-4933 is a high (CVSS 7.8) Credentials Management Errors vulnerability in novell zenworks_asset_management. EPSS estimates a 44.01% chance of exploitation in the next 30 days, higher than 98.7% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 20-10-2012PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The rtrlet web application in the Web Console in Novell ZENworks Asset Management (ZAM) 7.5 uses a hard-coded username of Ivanhoe and a hard-coded password of Scott for the (1) GetFile_Password and (2) GetConfigInfo_Password operations, which allows remote attackers to obtain sensitive information via a crafted rtrlet/rtr request for the HandleMaintenanceCalls function.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
44.01%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 44.01% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (community.rapid7.com)
Maturity: unknown
Novell ZENworks Asset Management 7.5 Remote File Access
auxiliary/scanner/http/zenworks_assetmanagement_fileaccess
Maturity: poc
Novell ZENworks Asset Management 7.5 Configuration Access
auxiliary/scanner/http/zenworks_assetmanagement_getconfig
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Novell1 product
1 vendor · 1 product
References
4 links- community.rapid7.com/community/metasploit/blog/2012/10/15/cve-2012-4933-novell-zenworksX Refsource MISCExploit