CVE-2018-1215: dell emc_solutions_enabler_virtual_appliance

Vulnerability summary

CVE-2018-1215 is a high (CVSS 9.0) vulnerability in dell emc_solutions_enabler_virtual_appliance. EPSS estimates a 4.20% chance of exploitation in the next 30 days, higher than 90.8% of scored vulnerabilities.

Timeline

1. 08-03-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

An arbitrary file upload vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement): Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.18, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.21, Dell EMC VASA Virtual Appliance versions prior to 8.4.0.514, and Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4 (Enginuity Release 5977.1125.1125 and earlier). A remote authenticated malicious user may potentially upload arbitrary maliciously crafted files in any location on the web server. By chaining this vulnerability with CVE-2018-1216, the attacker may use the default account to exploit this vulnerability.

• CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.