PT-2017-18065 · Emc+1 · Emc M&R (Watch4Net) For Sas Solution Packs+5

Publicado 2017-09-22 · Atualizado 2021-09-13 · CVE-2017-8007

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC VNX Monitoring and Reporting Scheduler versions (affected versions not specified)

Description The issue concerns a directory traversal vulnerability in the Webservice Gateway of EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs. This vulnerability could allow attackers with Webservice Gateway credentials to access unauthorized information, modify data, or delete data by providing specially crafted strings in input parameters of the web service call.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-8007

ZDI-17-827

Produtos afetados

Dell Emc Vnx Monitoring/Reporting Scheduler

Emc Vipr Srm

Emc M&R (Watch4Net) For Sas Solution Packs

Storage M&R

Vnx M&R

Webservice Gateway

Referências · 7

• http://securitytracker.com/id/1039418 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-8007 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-8007 · Aviso do Fabricante
• http://securitytracker.com/id/1039417 · Nota
• https://zerodayinitiative.com/advisories/ZDI-17-827 · Nota de Segurança
• http://seclists.org/fulldisclosure/2017/Sep/51 · Nota
• http://securityfocus.com/bid/100957 · Nota