Lucene search

[email protected]CVE-2019-18581

HistoryMar 18, 2020 - 7:15 p.m.

CVE-2019-18581

2020-03-1819:15:16

CWE-862

[email protected]

web.nvd.nist.gov

dell emc

data protection advisor

cve-2019-18581

authorization vulnerability

remote attack

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.3%

JSON

Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server missing authorization vulnerability in the REST API. A remote authenticated malicious user with administrative privileges may potentially exploit this vulnerability to alter the application’s allowable list of OS commands. This may lead to arbitrary OS command execution as the regular user runs the DPA service on the affected system.

Affected configurations

NVD

Node

dellemc_data_protection_advisorMatch6.3

dellemc_data_protection_advisorMatch6.4

dellemc_data_protection_advisorMatch6.5

dellemc_data_protection_advisorMatch18.1

dellemc_data_protection_advisorMatch18.2-

dellemc_data_protection_advisorMatch19.1-

Node

dellemc_integrated_data_protection_appliance_firmwareMatch2.0

dellemc_integrated_data_protection_appliance_firmwareMatch2.1

dellemc_integrated_data_protection_appliance_firmwareMatch2.2

dellemc_integrated_data_protection_appliance_firmwareMatch2.3

dellemc_integrated_data_protection_appliance_firmwareMatch2.4

AND

dellemc_idpa_dp4400Match-

dellemc_idpa_dp5800Match-

dellemc_idpa_dp8300Match-

dellemc_idpa_dp8800Match-

CPENameOperatorVersion
dell:emc_data_protection_advisordell emc data protection advisoreq6.3
dell:emc_data_protection_advisordell emc data protection advisoreq6.4
dell:emc_data_protection_advisordell emc data protection advisoreq6.5
dell:emc_data_protection_advisordell emc data protection advisoreq18.1
dell:emc_data_protection_advisordell emc data protection advisoreq18.2
dell:emc_data_protection_advisordell emc data protection advisoreq19.1

CPE	Name	Operator	Version
dell:emc_data_protection_advisor	dell emc data protection advisor	eq	6.3
dell:emc_data_protection_advisor	dell emc data protection advisor	eq	6.4
dell:emc_data_protection_advisor	dell emc data protection advisor	eq	6.5
dell:emc_data_protection_advisor	dell emc data protection advisor	eq	18.1
dell:emc_data_protection_advisor	dell emc data protection advisor	eq	18.2
dell:emc_data_protection_advisor	dell emc data protection advisor	eq	19.1

CNA Affected

[
  {
    "product": "Data Protection Advisor",
    "vendor": "Dell",
    "versions": [
      {
        "lessThan": "6.3, 6.4, 6.5 and version prior to 18.2 patch 83 and prior to 19.1 patch 71",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.dell.com/support/security/en-us/details/539430/DSA-2019-155-Dell-EMC-Data-Protection-Advisor-Security-Update-for-Multiple-Vulnerabilities

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.3%

JSON

Related for CVE-2019-18581

prion1 cvelist1 nvd1