Medium severity · published Mar 26, 2018
CVE-2018-1204
Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a path traversal…
6.7
CVSS
2.3%
EPSS
No
On KEV
Description
Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a path traversal vulnerability in the isi_phone_home tool. A malicious compadmin may potentially exploit this vulnerability to execute arbitrary code with root privileges.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EI
Emc Isilon Onefs · Dell
7.2.1.0 through 7.2.1.6; 8.0.0.0 through 8.0.0.6; 8.0.1.0 through 8.0.1.2; 8.1.0.0 through 8.1.0.1; 7.1.1.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1204
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1204
Mailing List
http://seclists.org/fulldisclosure/2018/Mar/50
Third Party Advisory
http://www.securityfocus.com/bid/103033
Exploit
https://www.coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities
Exploit
https://www.exploit-db.com/exploits/44039/
More from Emc Isilon Onefs
9.8
CVE-2020-5328
Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough authorization checks when SyncIQ is licensed, but encrypted…
8.8
CVE-2020-5353
The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for Network File System (NFS) allows access to an 'admin' home…
8.8
CVE-2020-26180
Dell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an access issue with the remotesupport user account
8.8
CVE-2020-5369
Dell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability
8.8
CVE-2020-5371
Dell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale version 9.0.0 contain a file permissions vulnerability