CVE-2018-6961

Опубликовано: 11 июн. 2018

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Критический

Описание

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution.

Ссылки

http://www.securityfocus.com/bid/104185
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1041210
Broken Link
Third Party Advisory
VDB Entry
http://www.vmware.com/security/advisories/VMSA-2018-0011.html
Vendor Advisory
https://www.exploit-db.com/exploits/44959/
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/104185
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1041210
Broken Link
Third Party Advisory
VDB Entry
http://www.vmware.com/security/advisories/VMSA-2018-0011.html
Vendor Advisory
https://www.exploit-db.com/exploits/44959/
Exploit
Third Party Advisory
VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6961
US Government Resource

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:vmware:nsx_sd-wan_by_velocloud:*:*:*:*:*:*:*:*

Версия до 3.1.0 (исключая)

EPSS

Процентиль: 100%

0.93648

Критический

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-rvjq-qp5f-gvx6