PT-2018-5915 · Emc · Emc Avamar Server+2

Michael Cramer · Publicado 2018-01-05 · Atualizado 2018-01-18 · CVE-2017-15549

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: EMC Avamar Server versions 7.1.x through 7.5.0 EMC NetWorker Virtual Edition (NVE) versions 9.0.x through 9.2.x EMC Integrated Data Protection Appliance version 2.0

Description: A remote authenticated malicious user with low privileges could potentially upload arbitrary maliciously crafted files in any location on the server file system.

Recommendations: For EMC Avamar Server versions 7.1.x through 7.5.0, restrict access to file upload functionality to minimize the risk of exploitation. For EMC NetWorker Virtual Edition (NVE) versions 9.0.x through 9.2.x, consider disabling file upload features until a fix is available. For EMC Integrated Data Protection Appliance version 2.0, limit user privileges to prevent unauthorized file uploads.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2017-15549

Produtos afetados

Emc Avamar Server

Emc Integrated Data Protection Appliance

Emc Networker Virtual Edition

Referências · 5

• http://seclists.org/fulldisclosure/2018/Jan/17 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-15549 · Nota de Segurança
• http://securitytracker.com/id/1040070 · Nota
• https://osv.dev/vulnerability/CVE-2017-15549 · Aviso do Fabricante
• http://securityfocus.com/bid/102363 · Nota