Lucene search

DellCVE-2018-1242

HistoryMay 29, 2018 - 5:29 p.m.

CVE-2018-1242

2018-05-2917:29:00

CWE-78

dell

web.nvd.nist.gov

dell emc

recoverpoint

command injection

vulnerability

boxmgmt cli

nvd

cve-2018-1242

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

35.1%

JSON

Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contains a command injection vulnerability in the Boxmgmt CLI. An authenticated malicious user with boxmgmt privileges may potentially exploit this vulnerability to read RPA files. Note that files that require root permission cannot be read.

Affected configurations

Nvd

Vulners

Node

emcrecoverpointRange<5.1.2

emcrecoverpoint_for_virtual_machinesRange<5.1.1.3

VendorProductVersionCPE
emcrecoverpoint*cpe:2.3:a:emc:recoverpoint:*:*:*:*:*:*:*:*
emcrecoverpoint_for_virtual_machines*cpe:2.3:a:emc:recoverpoint_for_virtual_machines:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
emc	recoverpoint	*	cpe:2.3:a:emc:recoverpoint::::::::
emc	recoverpoint_for_virtual_machines	*	cpe:2.3:a:emc:recoverpoint_for_virtual_machines::::::::

CNA Affected

[
  {
    "product": "Dell EMC RecoverPoint",
    "vendor": "Dell EMC",
    "versions": [
      {
        "lessThan": "5.1.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Dell EMC RecoverPoint Virtual Machine (VM)",
    "vendor": "Dell EMC",
    "versions": [
      {
        "lessThan": "5.1.1.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

seclists.org/fulldisclosure/2018/May/61

www.securityfocus.com/bid/104246

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

35.1%

JSON

Related for CVE-2018-1242