PT-2018-11035 · Dell Emc · Dell Emc Unisphere For Vmax Virtual Appliance+3

Carlos Perez · Publicado 2018-03-08 · Atualizado 2018-03-29 · CVE-2018-1215

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.18 Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.21 Dell EMC VASA Virtual Appliance versions prior to 8.4.0.514 Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4

Description An arbitrary file upload issue was discovered, allowing a remote authenticated malicious user to upload arbitrary maliciously crafted files in any location on the web server. This could potentially be exploited by chaining with another issue, allowing an attacker to use a default account.

Recommendations For Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.18, update to version 8.4.0.18 or later. For Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.21, update to version 8.4.0.21 or later. For Dell EMC VASA Virtual Appliance versions prior to 8.4.0.514, update to version 8.4.0.514 or later. For Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4, update to a version later than 1.4.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-1215

Produtos afetados

Dell Emc Solutions Enabler Virtual Appliance

Dell Emc Unisphere For Vmax Virtual Appliance

Dell Emc Vasa Virtual Appliance

Dell Emc Vmax Embedded Management

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-1215 · Nota de Segurança
• http://securityfocus.com/bid/103039 · Nota
• http://securitytracker.com/id/1040383 · Nota
• https://osv.dev/vulnerability/CVE-2018-1215 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2018/Feb/41 · Nota
• https://tenable.com/security/research/tra-2018-03 · Nota