Backup server admin interface reachable from the customer network
Description
During the penetration test the tester reached the administration interface of the backup server from a laptop on the customer network. Only a password protected it. An attacker on that network could therefore try to guess the password and, once in, delete or read customer backups.
Summary
On trackThis workflow is complete.
Completed
on
The administration interface of the backup server now accepts connections from the management network only. The firewall rule was checked from the customer network and the page no longer loads.
Completed
on
A new scan from the customer network found no route to the interface, and the rule survived the next firewall change. The fix holds.