CVE-2018-1250

Опубликовано: 28 сент. 2018

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

Dell EMC Unity and UnityVSA versions prior to 4.3.1.1525703027 contains an Authorization Bypass vulnerability. A remote authenticated user could potentially exploit this vulnerability to read files in NAS server by directly interacting with certain APIs of Unity OE, bypassing Role-Based Authorization control implemented only in Unisphere GUI.

Ссылки

https://seclists.org/fulldisclosure/2018/Sep/30
Mailing List
Third Party Advisory
https://seclists.org/fulldisclosure/2018/Sep/30
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:dell:emc_unity_firmware:*:*:*:*:*:*:*:*

Версия до 4.3.1.1525703027 (исключая)

cpe:2.3:h:dell:emc_unity:-:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:dell:emc_unityvsa:*:*:*:*:*:*:*:*

Версия до 4.3.1.1525703027 (исключая)

EPSS

Процентиль: 29%

0.00103

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-863

Связанные уязвимости

GHSA-r6ff-xjxr-8vfh