PT-2018-11045 · Dell Emc · Dell Emc Integrated Data Protection Appliance+1

Slidingwindow · Publicado 2018-04-09 · Atualizado 2019-10-03 · CVE-2018-1217

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC Avamar Server versions 7.3.1 through 7.5.0 Dell EMC Integrated Data Protection Appliance versions 2.0 through 2.1

Description The issue is related to a missing access control check, which could allow a remote unauthenticated attacker to read or change the Local Download Service (LDLS) credentials. These credentials are used to connect to Dell EMC Online Support. An attacker could also use the credentials to login to Dell EMC Online Support, potentially impersonating the AVI service actions.

Recommendations For Dell EMC Avamar Server versions 7.3.1 through 7.5.0, update the Avamar Installation Manager to a version that includes the missing access control check. For Dell EMC Integrated Data Protection Appliance versions 2.0 through 2.1, update the appliance to a version that includes the missing access control check. As a temporary workaround, consider restricting access to the LDLS credentials to minimize the risk of exploitation.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2018-1217

Produtos afetados

Dell Emc Avamar Server

Dell Emc Integrated Data Protection Appliance

Referências · 5

• 🔥 https://exploit-db.com/exploits/44441 · Exploit
• https://osv.dev/vulnerability/CVE-2018-1217 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2018/Apr/14 · Nota
• http://securitytracker.com/id/1040641 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1217 · Nota de Segurança