CVE-2018-1238

Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent (LIA). This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user, with network access to LIA and knowledge of the LIA administrative password, could potentially exploit this vulnerability to run arbitrary commands as root on the systems where LIAs are installed.

CVSS v3 7.5 HIGH
CVSS v2.0 8.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

8.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:S/C:C/I:C/A:C

Exploitability : 6.8 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://seclists.org/fulldisclosure/2018/Mar/59	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2018/Mar/59	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dell:emc_scaleio:*:*:*:*:*:*:*:*

History

21 Nov 2024, 03:59

Type	Values Removed	Values Added
References	~~() http://seclists.org/fulldisclosure/2018/Mar/59 - Mailing List, Third Party Advisory~~	() http://seclists.org/fulldisclosure/2018/Mar/59 - Mailing List, Third Party Advisory

Information

Published : 2018-03-27 21:29

Updated : 2024-11-21 03:59

NVD link : CVE-2018-1238

Mitre link : CVE-2018-1238

CVE.ORG link : CVE-2018-1238

JSON object : View

Products Affected

dell

emc_scaleio

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2018-1238", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 8.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2018-03-27T21:29:00.907", "references": [{"url": "http://seclists.org/fulldisclosure/2018/Mar/59", "tags": ["Mailing List", "Third Party Advisory"], "source": "security_alert@emc.com"}, {"url": "http://seclists.org/fulldisclosure/2018/Mar/59", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent (LIA). This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user, with network access to LIA and knowledge of the LIA administrative password, could potentially exploit this vulnerability to run arbitrary commands as root on the systems where LIAs are installed."}, {"lang": "es", "value": "Dell EMC ScaleIO, en versiones anteriores a la 2.5, contiene una vulnerabilidad de inyecci\u00f3n de comandos en el agente de instalaci\u00f3n Light installation Agent (LIA). Este componente se emplea para la gesti\u00f3n central de la implementaci\u00f3n ScalelO y utiliza comandos shell para determinadas acciones. Un usuario malicioso remoto que tenga acceso de red a LIA y conozca la contrase\u00f1a de administraci\u00f3n de LIA podr\u00eda explotar esta vulnerabilidad para ejecutar comandos arbitrarios como root en los sistemas en los que haya agentes LIA instalados."}], "lastModified": "2024-11-21T03:59:26.560", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:emc_scaleio:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF2A63E9-84E6-4BD4-82BA-F7C39960E9FD", "versionEndExcluding": "2.5"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}