Multiple Dell EMC Products Arbitrary File Upload and Security Bypass Vulnerabilities
BID:103039
CVE-2018-1215 | CVE-2018-1216 |Info
Multiple Dell EMC Products Arbitrary File Upload and Security Bypass Vulnerabilities
| Bugtraq ID: | 103039 |
| Class: | Design Error |
| CVE: |
CVE-2018-1215 CVE-2018-1216 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 12 2018 12:00AM |
| Updated: | Feb 12 2018 12:00AM |
| Credit: | Carlos Perez from Tenable |
| Vulnerable: |
Dell EMC VMAX Embedded Management 1.4 Dell EMC VASA Virtual Appliance 8.4.0.512 Dell EMC Unisphere for VMAX 8.3 Dell EMC Unisphere for VMAX 8.2 Dell EMC Unisphere for VMAX 8.4.0.15 Dell EMC Solutions Enabler 8.3 Dell EMC Solutions Enabler 8.2 Dell EMC Solutions Enabler 8.4.0.15 Dell EMC Solutions Enabler 8.1.0.3 |
| Not Vulnerable: | |
Discussion
Multiple Dell EMC Products Arbitrary File Upload and Security Bypass Vulnerabilities
Multiple Dell EMC Products are prone to an arbitrary file-upload vulnerability and a security-bypass vulnerability.
An attacker can exploit these issues to upload arbitrary files in the context of the web server process or to bypass the security mechanism and perform unauthorized actions.
Following products and versions are vulnerable:
Versions prior to EMC Unisphere for VMAX Virtual Appliance 8.4.0.18
Versions prior to EMC Solutions Enabler Virtual Appliance8.4.0.21
Versions prior to EMC VASA Virtual Appliance 8.4.0.514
Dell EMC VMAX Embedded Management through 1.4
Multiple Dell EMC Products are prone to an arbitrary file-upload vulnerability and a security-bypass vulnerability.
An attacker can exploit these issues to upload arbitrary files in the context of the web server process or to bypass the security mechanism and perform unauthorized actions.
Following products and versions are vulnerable:
Versions prior to EMC Unisphere for VMAX Virtual Appliance 8.4.0.18
Versions prior to EMC Solutions Enabler Virtual Appliance8.4.0.21
Versions prior to EMC VASA Virtual Appliance 8.4.0.514
Dell EMC VMAX Embedded Management through 1.4
Exploit / POC
Multiple Dell EMC Products Arbitrary File Upload and Security Bypass Vulnerabilities
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Multiple Dell EMC Products Arbitrary File Upload and Security Bypass Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.