Medium severity · published Jul 9, 2017
CVE-2017-8003
EMC Data Protection Advisor prior to 6.4 contains a path traversal vulnerability
4.9
CVSS
2.6%
EPSS
No
On KEV
Description
EMC Data Protection Advisor prior to 6.4 contains a path traversal vulnerability. A remote authenticated high privileged user may potentially exploit this vulnerability to access unauthorized information from the underlying OS server by supplying specially crafted strings in input parameters of the application.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DP
Data Protection Advisor · Emc
through 6.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-8003
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-8003
Mailing List
http://seclists.org/fulldisclosure/2017/Jul/12
Third Party Advisory
http://www.securityfocus.com/bid/99487
Third Party Advisory
http://www.securitytracker.com/id/1038841
More from Data Protection Advisor
9.8
CVE-2017-8013
EMC Data Protection Advisor 6.3.x before patch 67 and 6.4.x before patch 130 contains undocumented accounts with hard-coded passwords and various privileges
8.8
CVE-2017-10955
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection Advisor 6.3.0
8.8
CVE-2017-8002
EMC Data Protection Advisor prior to 6.4 contains multiple blind SQL injection vulnerabilities
7.8
CVE-2018-1206
Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 and Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110 contain a hardcoded database account with…
–
CVE-2012-4616
Directory traversal vulnerability in the Web UI in EMC Data Protection Advisor (DPA) 5.6 through SP1, 5.7 through SP1, and 5.8 through SP4 allows remote attackers to read…