Lucene search

[email protected]NVD:CVE-2018-11048

HistoryAug 10, 2018 - 8:29 p.m.

CVE-2018-11048

2018-08-1020:29:00

CWE-611

[email protected]

web.nvd.nist.gov

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:N/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

AI Score

Confidence

High

EPSS

0.002

Percentile

61.6%

JSON

Dell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 contain a XML External Entity (XXE) Injection vulnerability in the REST API. An authenticated remote malicious user could potentially exploit this vulnerability to read certain system files in the server or cause denial of service by supplying specially crafted Document Type Definitions (DTDs) in an XML request.

Affected configurations

Nvd

Node

dellemc_data_protection_advisorMatch6.2

dellemc_data_protection_advisorMatch6.3

dellemc_data_protection_advisorMatch6.4

dellemc_data_protection_advisorMatch6.5

dellemc_integrated_data_protection_applianceMatch2.0

dellemc_integrated_data_protection_applianceMatch2.1

VendorProductVersionCPE
dellemc_data_protection_advisor6.2cpe:2.3:a:dell:emc_data_protection_advisor:6.2:*:*:*:*:*:*:*
dellemc_data_protection_advisor6.3cpe:2.3:a:dell:emc_data_protection_advisor:6.3:*:*:*:*:*:*:*
dellemc_data_protection_advisor6.4cpe:2.3:a:dell:emc_data_protection_advisor:6.4:*:*:*:*:*:*:*
dellemc_data_protection_advisor6.5cpe:2.3:a:dell:emc_data_protection_advisor:6.5:*:*:*:*:*:*:*
dellemc_integrated_data_protection_appliance2.0cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.0:*:*:*:*:*:*:*
dellemc_integrated_data_protection_appliance2.1cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	emc_data_protection_advisor	6.2	cpe:2.3:a:dell:emc_data_protection_advisor:6.2:::::::*
dell	emc_data_protection_advisor	6.3	cpe:2.3:a:dell:emc_data_protection_advisor:6.3:::::::*
dell	emc_data_protection_advisor	6.4	cpe:2.3:a:dell:emc_data_protection_advisor:6.4:::::::*
dell	emc_data_protection_advisor	6.5	cpe:2.3:a:dell:emc_data_protection_advisor:6.5:::::::*
dell	emc_integrated_data_protection_appliance	2.0	cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.0:::::::*
dell	emc_integrated_data_protection_appliance	2.1	cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.1:::::::*

References

seclists.org/fulldisclosure/2018/Aug/5

www.securityfocus.com/bid/105130

www.securitytracker.com/id/1041417

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:N/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

AI Score

Confidence

High

EPSS

0.002

Percentile

61.6%

JSON

Related for NVD:CVE-2018-11048

cloudfoundry2 prion1 cve1 cvelist1 nessus1