{"api_version":"1","generated_at":"2026-07-23T03:11:44+00:00","cve":"CVE-2011-1655","urls":{"html":"https://cve.report/CVE-2011-1655","api":"https://cve.report/api/cve/CVE-2011-1655.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2011-1655","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-1655"},"summary":{"title":"CVE-2011-1655","description":"The management.asmx module in the Management Web Service in the Unified Network Control (UNC) Server in CA Total Defense (TD) r12 before SE2 sends a cleartext response to unspecified getDBConfigSettings requests, which makes it easier for remote attackers to obtain database credentials, and subsequently execute arbitrary code, by sniffing the network, related to the UNCWS Web Service.","state":"PUBLISHED","assigner":"mitre","published_at":"2011-04-18 15:00:43","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-310","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.securityfocus.com/archive/1/517494/100/0/threaded","name":"http://www.securityfocus.com/archive/1/517494/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/44097","name":"http://secunia.com/advisories/44097","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"CA Total Defense Multiple Vulnerabilities - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/47356","name":"http://www.securityfocus.com/bid/47356","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Computer Associates Total Defense 'UNCSW' Service Remote Code Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7BCD065CEC-AFE2-4D9D-8E0B-BE7F6E345866%7D","name":"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7BCD065CEC-AFE2-4D9D-8E0B-BE7F6E345866%7D","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"error - ecx_site - ECX","mime":"text/html","httpstatus":"404","archivestatus":"400"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/66727","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/66727","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1025353","name":"http://securitytracker.com/id?1025353","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CA Total Defense Input Validation Flaw Lets Remote Users Inject SQL Commands - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/517492/100/0/threaded","name":"http://www.securityfocus.com/archive/1/517492/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2011/0977","name":"http://www.vupen.com/english/advisories/2011/0977","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Webmail - OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-11-127/","name":"http://www.zerodayinitiative.com/advisories/ZDI-11-127/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Zero Day Initiative","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID={CD065CEC-AFE2-4D9D-8E0B-BE7F6E345866}","name":"CONFIRM:https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID={CD065CEC-AFE2-4D9D-8E0B-BE7F6E345866}","refsource":"MITRE","tags":[],"title":"404 Not Found","mime":"text/html","httpstatus":"404","archivestatus":"400"},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-1655","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-1655","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2011","cve_id":"1655","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"broadcom","cpe5":"total_defense","cpe6":"r12","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T22:37:24.545Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20110413 ZDI-11-127: CA Total Defense Suite UNCWS Web Service getDBConfigSettings Credential Disclosure Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/517492/100/0/threaded"},{"name":"44097","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/44097"},{"name":"ADV-2011-0977","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2011/0977"},{"name":"1025353","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1025353"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7BCD065CEC-AFE2-4D9D-8E0B-BE7F6E345866%7D"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.zerodayinitiative.com/advisories/ZDI-11-127/"},{"name":"47356","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/47356"},{"name":"totaldefense-uncsw-code-execution(66727)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/66727"},{"name":"20110413 CA20110413-01: Security Notice for CA Total Defense","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/517494/100/0/threaded"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2011-04-13T00:00:00.000Z","descriptions":[{"lang":"en","value":"The management.asmx module in the Management Web Service in the Unified Network Control (UNC) Server in CA Total Defense (TD) r12 before SE2 sends a cleartext response to unspecified getDBConfigSettings requests, which makes it easier for remote attackers to obtain database credentials, and subsequently execute arbitrary code, by sniffing the network, related to the UNCWS Web Service."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-09T18:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"20110413 ZDI-11-127: CA Total Defense Suite UNCWS Web Service getDBConfigSettings Credential Disclosure Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/517492/100/0/threaded"},{"name":"44097","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/44097"},{"name":"ADV-2011-0977","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2011/0977"},{"name":"1025353","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1025353"},{"tags":["x_refsource_CONFIRM"],"url":"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7BCD065CEC-AFE2-4D9D-8E0B-BE7F6E345866%7D"},{"tags":["x_refsource_MISC"],"url":"http://www.zerodayinitiative.com/advisories/ZDI-11-127/"},{"name":"47356","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/47356"},{"name":"totaldefense-uncsw-code-execution(66727)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/66727"},{"name":"20110413 CA20110413-01: Security Notice for CA Total Defense","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/517494/100/0/threaded"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2011-1655","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The management.asmx module in the Management Web Service in the Unified Network Control (UNC) Server in CA Total Defense (TD) r12 before SE2 sends a cleartext response to unspecified getDBConfigSettings requests, which makes it easier for remote attackers to obtain database credentials, and subsequently execute arbitrary code, by sniffing the network, related to the UNCWS Web Service."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20110413 ZDI-11-127: CA Total Defense Suite UNCWS Web Service getDBConfigSettings Credential Disclosure Vulnerability","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/517492/100/0/threaded"},{"name":"44097","refsource":"SECUNIA","url":"http://secunia.com/advisories/44097"},{"name":"ADV-2011-0977","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2011/0977"},{"name":"1025353","refsource":"SECTRACK","url":"http://securitytracker.com/id?1025353"},{"name":"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID={CD065CEC-AFE2-4D9D-8E0B-BE7F6E345866}","refsource":"CONFIRM","url":"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID={CD065CEC-AFE2-4D9D-8E0B-BE7F6E345866}"},{"name":"http://www.zerodayinitiative.com/advisories/ZDI-11-127/","refsource":"MISC","url":"http://www.zerodayinitiative.com/advisories/ZDI-11-127/"},{"name":"47356","refsource":"BID","url":"http://www.securityfocus.com/bid/47356"},{"name":"totaldefense-uncsw-code-execution(66727)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/66727"},{"name":"20110413 CA20110413-01: Security Notice for CA Total Defense","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/517494/100/0/threaded"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2011-1655","datePublished":"2011-04-15T19:00:00.000Z","dateReserved":"2011-04-06T00:00:00.000Z","dateUpdated":"2024-08-06T22:37:24.545Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2011-04-18 15:00:43","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-310","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:total_defense:r12:*:*:*:*:*:*:*","matchCriteriaId":"EAD87D20-B6C6-4D48-BEF7-5960AB2060D0"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2011","CveId":"1655","Ordinal":"1","Title":"CVE-2011-1655","CVE":"CVE-2011-1655","Year":"2011"},"notes":[{"CveYear":"2011","CveId":"1655","Ordinal":"1","NoteData":"The management.asmx module in the Management Web Service in the Unified Network Control (UNC) Server in CA Total Defense (TD) r12 before SE2 sends a cleartext response to unspecified getDBConfigSettings requests, which makes it easier for remote attackers to obtain database credentials, and subsequently execute arbitrary code, by sniffing the network, related to the UNCWS Web Service.","Type":"Description","Title":"CVE-2011-1655"},{"CveYear":"2011","CveId":"1655","Ordinal":"2","NoteData":"2011-04-15","Type":"Other","Title":"Published"},{"CveYear":"2011","CveId":"1655","Ordinal":"3","NoteData":"2018-10-09","Type":"Other","Title":"Modified"}]}}}