Lucene search

[email protected]CVE-2018-16494

HistoryMay 26, 2021 - 7:15 p.m.

CVE-2018-16494

2021-05-2619:15:08

CWE-668

CWE-377

[email protected]

web.nvd.nist.gov

cve-2018-16494

vos

umask

file permissions

unauthorized access

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.4%

JSON

In VOS and overly permissive “umask” may allow for authorized users of the server to gain unauthorized access through insecure file permissions that can result in an arbitrary read, write, or execution of newly created files and directories. Insecure umask setting was present throughout the Versa servers.

Affected configurations

NVD

Node

versa-networksversa_operating_systemRange<16.1r2s11

versa-networksversa_operating_systemRange20.2.0–20.2.2

versa-networksversa_operating_systemRange21.1.0–21.1.1

CPENameOperatorVersion
versa-networks:versa_operating_systemversa-networks versa operating systemlt16.1r2s11
versa-networks:versa_operating_systemversa-networks versa operating systemlt20.2.2
versa-networks:versa_operating_systemversa-networks versa operating systemlt21.1.1

CPE	Name	Operator	Version
versa-networks:versa_operating_system	versa-networks versa operating system	lt	16.1r2s11
versa-networks:versa_operating_system	versa-networks versa operating system	lt	20.2.2
versa-networks:versa_operating_system	versa-networks versa operating system	lt	21.1.1

CNA Affected

[
  {
    "product": "Versa VOS",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed Versions: 16.1R2S11, 20.2.2, 21.1.1, 21.2.1"
      }
    ]
  }
]

References

hackerone.com/reports/1168191

Social References

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.4%

JSON

Related for CVE-2018-16494

cvelist1 prion1 hackerone1 nvd1