PT-2017-18065 · Emc+1 · Emc M&R (Watch4Net) For Sas Solution Packs+5

Published 2017-09-22 · Updated 2021-09-13 · CVE-2017-8007

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC VNX Monitoring and Reporting Scheduler versions (affected versions not specified)

Description The issue concerns a directory traversal vulnerability in the Webservice Gateway of EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs. This vulnerability could allow attackers with Webservice Gateway credentials to access unauthorized information, modify data, or delete data by providing specially crafted strings in input parameters of the web service call.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-8007

ZDI-17-827

Affected Products

Dell Emc Vnx Monitoring/Reporting Scheduler

Emc Vipr Srm

Emc M&R (Watch4Net) For Sas Solution Packs

Storage M&R

Vnx M&R

Webservice Gateway

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2017-8007 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8007 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-17-827 · Security Note
• http://securitytracker.com/id/1039418 · Note
• http://securitytracker.com/id/1039417 · Note
• http://seclists.org/fulldisclosure/2017/Sep/51 · Note
• http://securityfocus.com/bid/100957 · Note