CVE-2017-14380

Summary

CVE	CVE-2017-14380
State	PUBLISHED
Assigner	dell
Source Priority	CVE Program / NVD first with legacy fallback
Published	2017-12-13 20:29:00 UTC
Updated	2025-04-20 01:37:25 UTC
Description	In EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, 8.0.0.0 - 8.0.0.4, 7.2.1.0 - 7.2.1.5, 7.2.0.x, and 7.1.1.x, a malicious compliance admin (compadmin) account user could exploit a vulnerability in isi_get_itrace or isi_get_profile maintenance scripts to run any shell script as system root on a cluster in compliance mode. This could potentially lead to an elevation of privilege for the compadmin user and violate compliance mode.

Primary CVSS: v3.0 6.7 MEDIUM from [email protected]

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.000590000 probability, percentile 0.183660000 (date 2026-05-18)

Problem Types: CWE-269 | Privilege Escalation Vulnerability

Version	Source	Type	Score	Severity	Vector
3.0	[email protected]	Primary	6.7	MEDIUM	`CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`
2.0	[email protected]	Primary	7.2		`AV:L/AC:L/Au:N/C:C/I:C/A:C`

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Access Vector

Local

Access Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

AV:L/AC:L/Au:N/C:C/I:C/A:C

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Emc	Isilon Onefs	7.1.1.0	All	All	All
Operating System	Emc	Isilon Onefs	7.1.1.1	All	All	All
Operating System	Emc	Isilon Onefs	7.1.1.2	All	All	All
Operating System	Emc	Isilon Onefs	7.1.1.3	All	All	All
Operating System	Emc	Isilon Onefs	7.1.1.4	All	All	All
Operating System	Emc	Isilon Onefs	7.1.1.5	All	All	All
Operating System	Emc	Isilon Onefs	7.2.0.0	All	All	All
Operating System	Emc	Isilon Onefs	7.2.0.1	All	All	All
Operating System	Emc	Isilon Onefs	7.2.0.2	All	All	All
Operating System	Emc	Isilon Onefs	7.2.0.3	All	All	All
Operating System	Emc	Isilon Onefs	7.2.0.4	All	All	All
Operating System	Emc	Isilon Onefs	7.2.0.5	All	All	All
Operating System	Emc	Isilon Onefs	7.2.1.0	All	All	All
Operating System	Emc	Isilon Onefs	7.2.1.1	All	All	All
Operating System	Emc	Isilon Onefs	7.2.1.2	All	All	All
Operating System	Emc	Isilon Onefs	7.2.1.3	All	All	All
Operating System	Emc	Isilon Onefs	7.2.1.4	All	All	All
Operating System	Emc	Isilon Onefs	7.2.1.5	All	All	All
Operating System	Emc	Isilon Onefs	8.0.0.0	All	All	All
Operating System	Emc	Isilon Onefs	8.0.0.1	All	All	All
Operating System	Emc	Isilon Onefs	8.0.0.2	All	All	All
Operating System	Emc	Isilon Onefs	8.0.0.3	All	All	All
Operating System	Emc	Isilon Onefs	8.0.0.4	All	All	All
Operating System	Emc	Isilon Onefs	8.0.1.0	All	All	All
Operating System	Emc	Isilon Onefs	8.0.1.1	All	All	All
Operating System	Emc	Isilon Onefs	8.1.0.0	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Na	EMC Isilon OneFS 8.1.0.0 8.0.1.0 8.0.1.1 8.0.0.0 - 8.0.0.4 7.2.1.0 - 7.2.1.5 7.2.0.x 7.1.1.x	affected EMC Isilon OneFS 8.1.0.0, 8.0.1.0 8.0.1.1, 8.0.0.0 - 8.0.0.4, 7.2.1.0 - 7.2.1.5, 7.2.0.x, 7.1.1.x	Not specified

Reference	Source	Link	Tags
Full Disclosure: ESA-2017-153: EMC Isilon OneFS Privilege Escalation Vulnerability	af854a3a-2127-422b-91ae-364da2661108	seclists.org	Mailing List, Third Party Advisory
EMC Isilon OneFS CVE-2017-14380 Multiple Privilege Escalation Vulnerabilities	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com	Third Party Advisory, VDB Entry
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.