Lucene search

DellCVE-2018-11064

HistoryOct 05, 2018 - 9:29 p.m.

CVE-2018-11064

2018-10-0521:29:00

CWE-732

dell

web.nvd.nist.gov

cve-2018-11064

dell

emc

unity

unityvsa

incorrect file permissions

vulnerability

nvd

security

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

Percentile

12.6%

JSON

Dell EMC Unity OE versions 4.3.0.x and 4.3.1.x and UnityVSA OE versions 4.3.0.x and 4.3.1.x contains an Incorrect File Permissions vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability to alter multiple library files in service tools that might result in arbitrary code execution with elevated privileges. No user file systems are directly affected by this vulnerability.

Affected configurations

Nvd

Vulners

Node

dellemc_unity_operating_environmentRange4.3.0.1522077968–4.3.1.1525703027

dellemc_unityvsa_operating_environmentRange4.3.0.1522077968–4.3.1.1525703027

VendorProductVersionCPE
dellemc_unity_operating_environment*cpe:2.3:a:dell:emc_unity_operating_environment:*:*:*:*:*:*:*:*
dellemc_unityvsa_operating_environment*cpe:2.3:a:dell:emc_unityvsa_operating_environment:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	emc_unity_operating_environment	*	cpe:2.3:a:dell:emc_unity_operating_environment::::::::
dell	emc_unityvsa_operating_environment	*	cpe:2.3:a:dell:emc_unityvsa_operating_environment::::::::

CNA Affected

[
  {
    "product": "Dell EMC Unity",
    "vendor": "Dell EMC",
    "versions": [
      {
        "lessThanOrEqual": "4.3.1.x",
        "status": "affected",
        "version": "4.3.0.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Dell EMC UnityVSA",
    "vendor": "Dell EMC",
    "versions": [
      {
        "lessThanOrEqual": "4.3.1.x",
        "status": "affected",
        "version": "4.3.0.x",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/105447

seclists.org/fulldisclosure/2018/Sep/55

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2018-11064