High severity · published Mar 26, 2018
CVE-2018-1213
Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 and 8.1.0.2 is affected by a cross-site…
8.8
CVSS
1.9%
EPSS
No
On KEV
Description
Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 and 8.1.0.2 is affected by a cross-site request forgery vulnerability. A malicious user may potentially exploit this vulnerability to send unauthorized requests to the server on behalf of authenticated users of the application.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EI
Emc Isilon Onefs · Dell
7.2.1.0 through 7.2.1.6; 8.0.0.0 through 8.0.0.6; 8.0.1.0 through 8.0.1.2; 8.1.0.0 through 8.1.0.1; 7.1.1.11; 8.1.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1213
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1213
Mailing List
http://seclists.org/fulldisclosure/2018/Mar/50
Third Party Advisory
http://www.securityfocus.com/bid/103033
Exploit
https://www.coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities
Exploit
https://www.exploit-db.com/exploits/44039/
More from Emc Isilon Onefs
9.8
CVE-2020-5328
Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough authorization checks when SyncIQ is licensed, but encrypted…
8.8
CVE-2020-5353
The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for Network File System (NFS) allows access to an 'admin' home…
8.8
CVE-2020-26180
Dell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an access issue with the remotesupport user account
8.8
CVE-2020-5369
Dell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability
8.8
CVE-2020-5371
Dell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale version 9.0.0 contain a file permissions vulnerability