← Back

CVE-2018-1185

nvd nist
Published: Feb 3, 2018Modified: Nov 21, 2024

JSON object

Loading...
6.7
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 0.8 / Impact: 5.9
Source: NVD

Description

An issue was discovered in EMC RecoverPoint for Virtual Machines versions prior to 5.1.1, EMC RecoverPoint version 5.1.0.0, and EMC RecoverPoint versions prior to 5.0.1.3. Command injection vulnerability in Admin CLI may allow a malicious user with admin privileges to escape from the restricted shell to an interactive shell and run arbitrary commands with root privileges.

Affected (3)

Dell
2 products
Emc Recoverpoint
Emc Recoverpoint For Virtual Machines
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Dell
Emc Recoverpoint
Before 5.0.1.3
Emc Recoverpoint
Version 5.1.0.0
Emc Recoverpoint For Virtual Machines
Before 5.1.1

Related CWEs

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (6)

Source: security_alert@emc.com
Mailing ListPatchThird Party Advisory
Source: security_alert@emc.com
Third Party AdvisoryVDB Entry
Source: security_alert@emc.com
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry

Timeline

No history available yet.