CVE-2014-4867

2014-10-1010:55:07

CWE-264

[email protected]

web.nvd.nist.gov

cryoserver

security

appliance

weak permissions

cve-2014-4867

nvd

cryo-mgmt

6.8 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:S/C:C/I:C/A:C

6.9 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

0.4%

JSON

Cryoserver Security Appliance 7.3.x uses weak permissions for /etc/init.d/cryoserver, which allows local users to gain privileges by leveraging access to the support account and running the /bin/cryo-mgmt program.

Affected configurations

NVD

Node

cryoservercryoserver_security_applianceMatch7.3.0

cryoservercryoserver_security_applianceMatch7.3.0a

cryoservercryoserver_security_applianceMatch7.3.1

cryoservercryoserver_security_applianceMatch7.3.1a

cryoservercryoserver_security_applianceMatch7.3.2

cryoservercryoserver_security_applianceMatch7.3.3

cryoservercryoserver_security_applianceMatch7.3.4

CPENameOperatorVersion
cryoserver:cryoserver_security_appliancecryoserver cryoserver security applianceeq7.3.0
cryoserver:cryoserver_security_appliancecryoserver cryoserver security applianceeq7.3.1
cryoserver:cryoserver_security_appliancecryoserver cryoserver security applianceeq7.3.2
cryoserver:cryoserver_security_appliancecryoserver cryoserver security applianceeq7.3.3
cryoserver:cryoserver_security_appliancecryoserver cryoserver security applianceeq7.3.4

CPE	Name	Operator	Version
cryoserver:cryoserver_security_appliance	cryoserver cryoserver security appliance	eq	7.3.0
cryoserver:cryoserver_security_appliance	cryoserver cryoserver security appliance	eq	7.3.1
cryoserver:cryoserver_security_appliance	cryoserver cryoserver security appliance	eq	7.3.2
cryoserver:cryoserver_security_appliance	cryoserver cryoserver security appliance	eq	7.3.3
cryoserver:cryoserver_security_appliance	cryoserver cryoserver security appliance	eq	7.3.4