Lucene search

HuaweiCVE-2017-8132

HistoryNov 22, 2017 - 7:29 p.m.

CVE-2017-8132

2017-11-2219:29:02

CWE-77

huawei

web.nvd.nist.gov

cve-2017-8132

fusionsphere openstack

v100r006c00

v100r006c10

command injection

insufficient input validation

tcp listening ports

nvd

CVSS2

8.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

37.0%

JSON

The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands.

Affected configurations

Nvd

Node

huaweifusionsphere_openstackMatchv100r006c00

huaweifusionsphere_openstackMatchv100r006c10

VendorProductVersionCPE
huaweifusionsphere_openstackv100r006c00cpe:2.3:o:huawei:fusionsphere_openstack:v100r006c00:*:*:*:*:*:*:*
huaweifusionsphere_openstackv100r006c10cpe:2.3:o:huawei:fusionsphere_openstack:v100r006c10:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	fusionsphere_openstack	v100r006c00	cpe:2.3:o:huawei:fusionsphere_openstack:v100r006c00:::::::*
huawei	fusionsphere_openstack	v100r006c10	cpe:2.3:o:huawei:fusionsphere_openstack:v100r006c10:::::::*

CNA Affected

[
  {
    "product": "FusionSphere OpenStack",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "V100R006C00 and V100R006C10"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20170531-01-openstack-en

CVSS2

8.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

37.0%

JSON

Related for CVE-2017-8132