PT-2018-11035 · Dell Emc · Dell Emc Unisphere For Vmax Virtual Appliance+3

Carlos Perez · Published 2018-03-08 · Updated 2018-03-29 · CVE-2018-1215

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.18 Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.21 Dell EMC VASA Virtual Appliance versions prior to 8.4.0.514 Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4

Description An arbitrary file upload issue was discovered, allowing a remote authenticated malicious user to upload arbitrary maliciously crafted files in any location on the web server. This could potentially be exploited by chaining with another issue, allowing an attacker to use a default account.

Recommendations For Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.18, update to version 8.4.0.18 or later. For Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.21, update to version 8.4.0.21 or later. For Dell EMC VASA Virtual Appliance versions prior to 8.4.0.514, update to version 8.4.0.514 or later. For Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4, update to a version later than 1.4.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-1215

Affected Products

Dell Emc Solutions Enabler Virtual Appliance

Dell Emc Unisphere For Vmax Virtual Appliance

Dell Emc Vasa Virtual Appliance

Dell Emc Vmax Embedded Management

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-1215 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1215 · Vendor Advisory
• http://securityfocus.com/bid/103039 · Note
• http://securitytracker.com/id/1040383 · Note
• http://seclists.org/fulldisclosure/2018/Feb/41 · Note
• https://tenable.com/security/research/tra-2018-03 · Note