Lucene search

DellCVE-2017-15550

HistoryJan 05, 2018 - 5:29 p.m.

CVE-2017-15550

2018-01-0517:29:00

CWE-22

dell

web.nvd.nist.gov

emc

avamar server

networker virtual edition

nve

cve-2017-15550

security

path traversal

data protection

appliance

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.003

Percentile

70.0%

JSON

An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote authenticated malicious user with low privileges could access arbitrary files on the server file system in the context of the running vulnerable application via Path traversal.

Affected configurations

Nvd

Vulners

Node

emcavamar_serverMatch7.1-21sp2

emcavamar_serverMatch7.1-145sp1

emcavamar_serverMatch7.1-302

emcavamar_serverMatch7.1-370

emcavamar_serverMatch7.2-32sp1

emcavamar_serverMatch7.2-309

emcavamar_serverMatch7.2-401

emcavamar_serverMatch7.3-125sp1

emcavamar_serverMatch7.3-211

emcavamar_serverMatch7.3-226

emcavamar_serverMatch7.3-233

emcavamar_serverMatch7.4-58sp1

emcavamar_serverMatch7.4-242

emcavamar_serverMatch7.5-183

emcintegrated_data_protection_applianceMatch2.0

emcnetworkerMatch9.0virtual

emcnetworkerMatch9.1virtual

emcnetworkerMatch9.2virtual

VendorProductVersionCPE
emcavamar_server7.1-21cpe:2.3:a:emc:avamar_server:7.1-21:sp2:*:*:*:*:*:*
emcavamar_server7.1-145cpe:2.3:a:emc:avamar_server:7.1-145:sp1:*:*:*:*:*:*
emcavamar_server7.1-302cpe:2.3:a:emc:avamar_server:7.1-302:*:*:*:*:*:*:*
emcavamar_server7.1-370cpe:2.3:a:emc:avamar_server:7.1-370:*:*:*:*:*:*:*
emcavamar_server7.2-32cpe:2.3:a:emc:avamar_server:7.2-32:sp1:*:*:*:*:*:*
emcavamar_server7.2-309cpe:2.3:a:emc:avamar_server:7.2-309:*:*:*:*:*:*:*
emcavamar_server7.2-401cpe:2.3:a:emc:avamar_server:7.2-401:*:*:*:*:*:*:*
emcavamar_server7.3-125cpe:2.3:a:emc:avamar_server:7.3-125:sp1:*:*:*:*:*:*
emcavamar_server7.3-211cpe:2.3:a:emc:avamar_server:7.3-211:*:*:*:*:*:*:*
emcavamar_server7.3-226cpe:2.3:a:emc:avamar_server:7.3-226:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
emc	avamar_server	7.1-21	cpe:2.3:a:emc:avamar_server:7.1-21:sp2::::::
emc	avamar_server	7.1-145	cpe:2.3:a:emc:avamar_server:7.1-145:sp1::::::
emc	avamar_server	7.1-302	cpe:2.3:a:emc:avamar_server:7.1-302:::::::*
emc	avamar_server	7.1-370	cpe:2.3:a:emc:avamar_server:7.1-370:::::::*
emc	avamar_server	7.2-32	cpe:2.3:a:emc:avamar_server:7.2-32:sp1::::::
emc	avamar_server	7.2-309	cpe:2.3:a:emc:avamar_server:7.2-309:::::::*
emc	avamar_server	7.2-401	cpe:2.3:a:emc:avamar_server:7.2-401:::::::*
emc	avamar_server	7.3-125	cpe:2.3:a:emc:avamar_server:7.3-125:sp1::::::
emc	avamar_server	7.3-211	cpe:2.3:a:emc:avamar_server:7.3-211:::::::*
emc	avamar_server	7.3-226	cpe:2.3:a:emc:avamar_server:7.3-226:::::::*

Rows per page:

1-10 of 181

CNA Affected

[
  {
    "product": "EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0, EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x, EMC Integrated Data Protection Appliance 2.0",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0, EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x, EMC Integrated Data Protection Appliance 2.0"
      }
    ]
  }
]

References

seclists.org/fulldisclosure/2018/Jan/17

www.securityfocus.com/bid/102358

www.securitytracker.com/id/1040070

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.003

Percentile

70.0%

JSON

Related for CVE-2017-15550