Lucene search

[email protected]CVE-2017-2719

HistoryNov 22, 2017 - 7:29 p.m.

CVE-2017-2719

2017-11-2219:29:01

CWE-77

[email protected]

web.nvd.nist.gov

fusionsphere

openstack

command injection

vulnerability

root privileges

cve-2017-2719

8.3 High

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.7%

JSON

FusionSphere OpenStack with software V100R006C00 and V100R006C10RC2 has two command injection vulnerabilities due to the insufficient input validation on one port. An attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands.

Affected configurations

NVD

Node

huaweifusionsphere_openstackMatchv100r006c00

huaweifusionsphere_openstackMatchv100r006c10rc2

CPENameOperatorVersion
huawei:fusionsphere_openstackhuawei fusionsphere openstackeqv100r006c00
huawei:fusionsphere_openstackhuawei fusionsphere openstackeqv100r006c10rc2

CPE	Name	Operator	Version
huawei:fusionsphere_openstack	huawei fusionsphere openstack	eq	v100r006c00
huawei:fusionsphere_openstack	huawei fusionsphere openstack	eq	v100r006c10rc2

CNA Affected

[
  {
    "product": "FusionSphere OpenStack",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "V100R006C00&#xa3"
      },
      {
        "status": "affected",
        "version": "&#xac"
      },
      {
        "status": "affected",
        "version": "V100R006C10RC2"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20170823-01-openstack-en

8.3 High

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.7%

JSON

Related for CVE-2017-2719

cvelist1 huawei2 nvd1 prion1