High severity · published Oct 5, 2018
CVE-2018-11064
Dell EMC Unity OE versions 4.3.0.x and 4.3.1.x and UnityVSA OE versions 4.3.0.x and 4.3.1.x contains an Incorrect File Permissions vulnerability
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
Dell EMC Unity OE versions 4.3.0.x and 4.3.1.x and UnityVSA OE versions 4.3.0.x and 4.3.1.x contains an Incorrect File Permissions vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability to alter multiple library files in service tools that might result in arbitrary code execution with elevated privileges. No user file systems are directly affected by this vulnerability.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EU
Emc Unity Operating Environment · Dell
4.3.0.1522077968 through 4.3.1.1525703027 · source: NVD
EU
Emc Unityvsa Operating Environment · Dell
4.3.0.1522077968 through 4.3.1.1525703027 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-11064
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-11064
Third Party Advisory
http://www.securityfocus.com/bid/105447
Mailing List
https://seclists.org/fulldisclosure/2018/Sep/55
More from Emc Unity Operating Environment
9.8
CVE-2021-36287
Dell VNX2 for file version 8.1.21.266 and earlier, contain an unauthenticated remote code execution vulnerability which may lead unauthenticated users to execute commands on the…
9.8
CVE-2021-36294
Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability
9.8
CVE-2018-1183
In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual…
9.1
CVE-2021-36288
Dell VNX2 for File version 8.1.21.266 and earlier, contain a path traversal vulnerability which may lead unauthenticated users to read/write restricted files
7.8
CVE-2021-36289
Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability