Lucene search

DellCVE-2019-3734

HistoryJul 18, 2019 - 4:15 p.m.

CVE-2019-3734

2019-07-1816:15:12

dell

web.nvd.nist.gov

dell

emc

unity

unityvsa

vulnerability

nas server

quotas

configuration

unauthorized access

exploitation

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

29.9%

JSON

Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain an improper authorization vulnerability in NAS Server quotas configuration. A remote authenticated Unisphere Operator could potentially exploit this vulnerability to edit quota configuration of other users.

Affected configurations

Nvd

Vulners

Node

dellemc_unity_operating_environmentRange<5.0.0.0.5.116

dellemc_unityvsa_operating_environmentRange<5.0.0.0.5.116

VendorProductVersionCPE
dellemc_unity_operating_environment*cpe:2.3:a:dell:emc_unity_operating_environment:*:*:*:*:*:*:*:*
dellemc_unityvsa_operating_environment*cpe:2.3:a:dell:emc_unityvsa_operating_environment:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	emc_unity_operating_environment	*	cpe:2.3:a:dell:emc_unity_operating_environment::::::::
dell	emc_unityvsa_operating_environment	*	cpe:2.3:a:dell:emc_unityvsa_operating_environment::::::::

CNA Affected

[
  {
    "product": "Unity",
    "vendor": "DELL EMC",
    "versions": [
      {
        "lessThan": "5.0.0.0.5.116",
        "status": "affected",
        "version": "5.0",
        "versionType": "custom"
      }
    ]
  }
]

References

productsecurity-ux.ausmp1z1.pcf.dell.com/support/security/us/en/04/details/535028/DSA-2019-086-Dell-EMC-Unity-Family-Multiple-Vulnerabilities

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

29.9%

JSON

Related for CVE-2019-3734