Skip to Main Content
SEI Idea Portal
Status Submitted
Workspace HC-DPS-EI: CPACS
Created by Batuhan Yukselen
Created on Aug 10, 2022

Security Vulnerability: UV & ZFP backend user account info transferred to port 20000 of IMS server in clear-text form

No description provided
Description

Both ZFP and UV are connecting to port 20000 of IMS Server and sending across backend connectivity user account containing username and password (ZFP/WEBDXUSER user account) in clear-text form to IMS server.

Customer admin has just discovered this security gap with their third-party security scanner software and would like UV/ZFP to transmit login user account info to IMS server in encrypted form.


ZFP version: 6.0 SP11.2.2 (192.168.36.95)

UV version: 7.0.0.4.6 (192.168.36.96)