Lucene search

[email protected]CVE-2016-6648

HistoryFeb 03, 2017 - 7:59 a.m.

CVE-2016-6648

2017-02-0307:59:00

CWE-275

[email protected]

web.nvd.nist.gov

emc

recoverpoint

virtual machines

cve-2016-6648

information disclosure

vulnerability

permissions

system file

nvd

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

4.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.5 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

19.0%

JSON

EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0 are affected by sensitive information disclosure vulnerability as a result of incorrect permissions set on a sensitive system file. A malicious administrator with configuration privileges may access this sensitive system file and compromise the affected system.

Affected configurations

NVD

Node

emcrecoverpointRange≤4.4.1.0

emcrecoverpoint_for_virtual_machinesRange≤4.0

CPENameOperatorVersion
emc:recoverpointemc recoverpointle4.4.1.0
emc:recoverpoint_for_virtual_machinesemc recoverpoint for virtual machinesle4.0

CPE	Name	Operator	Version
emc:recoverpoint	emc recoverpoint	le	4.4.1.0
emc:recoverpoint_for_virtual_machines	emc recoverpoint for virtual machines	le	4.0

CNA Affected

[
  {
    "product": "EMC RecoverPoint and EMC RecoverPoint for Virtual Machines EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "EMC RecoverPoint and EMC RecoverPoint for Virtual Machines EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0"
      }
    ]
  }
]

References

www.securityfocus.com/archive/1/540058/30/0/threaded

www.securityfocus.com/bid/95821

www.securitytracker.com/id/1037727

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

4.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.5 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

19.0%

JSON

Related for CVE-2016-6648

prion1 cvelist1 nvd1