CVE-2017-8007
Dell EMC VNX Monitoring and Reporting Scheduler Directory Traversal Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs, the Webservice Gateway is affected by a directory traversal vulnerability. Attackers with knowledge of Webservice Gateway credentials could potentially exploit this vulnerability to access unauthorized information, and modify or delete data, by supplying specially crafted strings in input parameters of the web service call.
En EMC ViPR SRM, Storage MR, VNX MR y MR (Watch4Net) para SAS Solution Packs, la puerta de enlace del servicio web se ha visto afectado por una vulnerabilidad de salto de directorio. Los atacantes que conozcan las credenciales de la puerta de enlace del servicio web podrían explotar esta vulnerabilidad para acceder a información no autorizada y modificar o borrar datos proporcionando strings especialmente manipuladas en parámetros de entrada de la llamada del servicio web.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Dell EMC VNX Monitoring and Reporting. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within Scheduler.class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute arbitrary code under the context of SYSTEM.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-04-21 CVE Reserved
- 2017-09-20 CVE Published
- 2024-08-05 CVE Updated
- 2024-10-04 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| http://seclists.org/fulldisclosure/2017/Sep/51 | Mailing List |
|
| http://www.securityfocus.com/bid/100957 | Third Party Advisory | |
| http://www.securitytracker.com/id/1039417 | Third Party Advisory | |
| http://www.securitytracker.com/id/1039418 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Dell Search vendor "Dell" | Emc M\&r Search vendor "Dell" for product "Emc M\&r" | * | - |
Affected
| ||||||
| Dell Search vendor "Dell" | Emc Storage Monitoring And Reporting Search vendor "Dell" for product "Emc Storage Monitoring And Reporting" | * | - |
Affected
| ||||||
| Dell Search vendor "Dell" | Emc Vipr Srm Search vendor "Dell" for product "Emc Vipr Srm" | <= 4.0.2 Search vendor "Dell" for product "Emc Vipr Srm" and version " <= 4.0.2" | - |
Affected
| ||||||
| Dell Search vendor "Dell" | Emc Vnx Monitoring And Reporting Search vendor "Dell" for product "Emc Vnx Monitoring And Reporting" | * | - |
Affected
| ||||||