Current Security vulnerabilities in Spcieworks

spiceuser-9ztnj · 2021-06-10T19:18:13.000Z

I ran a GVM (openvas) vulnerability scan against my network. Sadly many CVEs were returned all stemming from Spiceworks. Is there a fix for all of these issues?
OpenSSL End of Life Detection Windows Severity:10.0 port 4343
OpenSSL End of Life Detection Windows Severity:10.0 port 8059
Apache Http Sever 2.4.20 - 2.4.39 multiple vulnerabilities Severity:7.8 port 4343
Apache Http Sever 2.4.20 - 2.4.39 multiple vulnerabilities Severity:7.8 port 8059
Apache Http Server multiple vulnerabilities Apr18 Severity 6.8 port 4343 and 8059
Apache http Server memory access vulnerability Severity:6.4 port 8059 and 4343

There are several more apache vulnerabilities listed that are under 6.4 vulnerability but there are quite a few. I understand this is a free software but I can’t run this on my network with all of these problems. Does anyone know how to upgrade apache and openssl without breaking Spiceworks?

milerky2 · 2021-06-10T19:47:07.000Z

I will wager that the overwhelming answer will be to move to their cloud product.

Mike400 · 2021-06-10T19:56:56.000Z

Spiceworks is no longer maintaining their Windows product. They have a cloud option and an Vmware appliance option, which they are maintaining.

Best option if you don’t want to change is simply ensure your Spiceworks server is doing nothing else and is protected from the general internet.

scheff1 · 2021-06-10T20:06:44.000Z

Welcome to Spiceworks and its community.

spiceuser-9ztnj:

I ran a GVM (openvas) vulnerability scan against my network. Sadly many CVEs were returned all stemming from Spiceworks. Is there a fix for all of these issues?

And which version of which edition do you use on your network?
Which agents in which versions of Spiceworks are running on your network?

Just to remind you that the legacy Windows edition of Spiceworks has stopped active development back in summer 2018. Support has since then become limited as announced in the product roadmap. And end of support and of life has been announced recently by end of this year. And if you refer to the Help Desk Server (HDS) edition, it has been updated recently.

Sean-Spiceworks · 2021-06-10T21:04:27.000Z

Hi, much like asked above, is this in relation to the legacy Desktop application (7.5)? If so, you may want to read this:

What’s going on with Spiceworks Tools & Apps in 2021? Spiceworks Support

Hi SpiceHeads, While we’ve been posting various updates as of late, we know many of you are curious about the direction of the Spiceworks Tools & Apps. We want to make sure you’re not just aware of our plans but are also a part of the conversation. The road behind us Our primary focus this year is on helping our members migrate off of the legacy Desktop application. Back in 2018, we announced that we were no longer going to be improving Spiceworks Desktop after version 7.5 and that version 8.0…

If this is not about the legacy Desktop application, please let us know!