Lucene search

DellCVE-2017-4989

HistoryJun 21, 2017 - 8:29 p.m.

CVE-2017-4989

2017-06-2120:29:00

CWE-287

dell

web.nvd.nist.gov

emc

avamar server

software

7.3.1-125

7.3.0-233

7.3.0-226

7.2.1-32

7.2.1-31

7.2.0-401

unauthenticated access

authentication bypass

system maintenance page

sensitive information viewing

software updates

maintenance workflows

cve-2017-4989

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.007

Percentile

80.4%

JSON

In EMC Avamar Server Software 7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401, an unauthenticated remote attacker may potentially bypass the authentication process to gain access to the system maintenance page. This may be exploited by an attacker to view sensitive information, perform software updates, or run maintenance workflows.

Affected configurations

Nvd

Vulners

Node

emcavamar_serverMatch7.2.0-401

emcavamar_serverMatch7.2.1-31

emcavamar_serverMatch7.2.1-32

emcavamar_serverMatch7.3.0-226

emcavamar_serverMatch7.3.0-233

emcavamar_serverMatch7.3.1-125

VendorProductVersionCPE
emcavamar_server7.2.0-401cpe:2.3:a:emc:avamar_server:7.2.0-401:*:*:*:*:*:*:*
emcavamar_server7.2.1-31cpe:2.3:a:emc:avamar_server:7.2.1-31:*:*:*:*:*:*:*
emcavamar_server7.2.1-32cpe:2.3:a:emc:avamar_server:7.2.1-32:*:*:*:*:*:*:*
emcavamar_server7.3.0-226cpe:2.3:a:emc:avamar_server:7.3.0-226:*:*:*:*:*:*:*
emcavamar_server7.3.0-233cpe:2.3:a:emc:avamar_server:7.3.0-233:*:*:*:*:*:*:*
emcavamar_server7.3.1-125cpe:2.3:a:emc:avamar_server:7.3.1-125:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
emc	avamar_server	7.2.0-401	cpe:2.3:a:emc:avamar_server:7.2.0-401:::::::*
emc	avamar_server	7.2.1-31	cpe:2.3:a:emc:avamar_server:7.2.1-31:::::::*
emc	avamar_server	7.2.1-32	cpe:2.3:a:emc:avamar_server:7.2.1-32:::::::*
emc	avamar_server	7.3.0-226	cpe:2.3:a:emc:avamar_server:7.3.0-226:::::::*
emc	avamar_server	7.3.0-233	cpe:2.3:a:emc:avamar_server:7.3.0-233:::::::*
emc	avamar_server	7.3.1-125	cpe:2.3:a:emc:avamar_server:7.3.1-125:::::::*

CNA Affected

[
  {
    "product": "EMC Avamar Server Software 7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "EMC Avamar Server Software 7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401"
      }
    ]
  }
]

References

www.securityfocus.com/archive/1/540754/30/0/threaded

www.securityfocus.com/bid/99243

www.securitytracker.com/id/1038718

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.007

Percentile

80.4%

JSON

Related for CVE-2017-4989