PT-2016-1755 · Emc · Emc Unisphere For Vmax Virtual Appliance

Published 2016-04-15 · Updated 2021-08-05 · CVE-2016-0889

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EMC Unisphere for VMAX Virtual Appliance versions prior to 8.2.0

Description The issue is related to an HTTP servlet in the vApp Manager component, which lacks sufficient input validation. This allows remote attackers to modify arbitrary files by providing a specially crafted pathname.

Recommendations For versions prior to 8.2.0, update to version 8.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vApp Manager component to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-01081

CVE-2016-0889

Affected Products

Emc Unisphere For Vmax Virtual Appliance

References · 6

• https://osv.dev/vulnerability/CVE-2016-0889 · Vendor Advisory
• http://seclists.org/bugtraq/2016/Apr/83 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01081 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-0889 · Security Note
• http://securitytracker.com/id/1035580 · Note
• https://t.me/cvenotify/18689 · Telegram Post