Vulnerabilites related to dell - emc_vasa_provider_virtual_appliance
CVE-2022-45103 (GCVE-0-2022-45103)
Vulnerability from cvelistv5
Published
2023-01-18 14:31
Modified
2025-04-03 18:04
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Summary
Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain an information disclosure vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to read arbitrary files on the underlying file system.
References
Impacted products
Vendor Product Version
Dell Unisphere for PowerMax vApp Version: 9.2.3.x
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:01:31.587Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/kbdoc/en-us/000207177/dsa-2022-340-dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-45103",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-02T16:10:27.465411Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-03T18:04:23.945Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unisphere for PowerMax vApp",
          "vendor": "Dell",
          "versions": [
            {
              "status": "affected",
              "version": "9.2.3.x"
            }
          ]
        }
      ],
      "datePublic": "2023-01-04T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cdiv\u003e\u003cdiv\u003eDell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain an information disclosure vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to read arbitrary files on the underlying file system.\u003c/div\u003e\u003c/div\u003e\n\n"
            }
          ],
          "value": "\nDell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain an information disclosure vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to read arbitrary files on the underlying file system.\n\n\n\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-18T14:31:56.582Z",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.dell.com/support/kbdoc/en-us/000207177/dsa-2022-340-dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2022-45103",
    "datePublished": "2023-01-18T14:31:56.582Z",
    "dateReserved": "2022-11-09T15:48:33.040Z",
    "dateUpdated": "2025-04-03T18:04:23.945Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-4997 (GCVE-0-2017-4997)
Vulnerability from cvelistv5
Published
2017-06-29 17:00
Modified
2024-08-05 14:47
Severity ?
CWE
  • Remote Code Execution Vulnerability
Summary
EMC VASA Provider Virtual Appliance versions 8.3.x and prior has an unauthenticated remote code execution vulnerability that could potentially be exploited by malicious users to compromise the affected system.
References
Impacted products
Vendor Product Version
n/a VASA Provider Virtual Appliance versions 8.3.x and prior Version: VASA Provider Virtual Appliance versions 8.3.x and prior
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:47:44.121Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "99169",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/99169"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/540783/30/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "VASA Provider Virtual Appliance versions 8.3.x and prior",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "VASA Provider Virtual Appliance versions 8.3.x and prior"
            }
          ]
        }
      ],
      "datePublic": "2017-06-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "EMC VASA Provider Virtual Appliance versions 8.3.x and prior has an unauthenticated remote code execution vulnerability that could potentially be exploited by malicious users to compromise the affected system."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution Vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T09:57:01",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "name": "99169",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/99169"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.securityfocus.com/archive/1/540783/30/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security_alert@emc.com",
          "ID": "CVE-2017-4997",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "VASA Provider Virtual Appliance versions 8.3.x and prior",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "VASA Provider Virtual Appliance versions 8.3.x and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "EMC VASA Provider Virtual Appliance versions 8.3.x and prior has an unauthenticated remote code execution vulnerability that could potentially be exploited by malicious users to compromise the affected system."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Remote Code Execution Vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "99169",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/99169"
            },
            {
              "name": "http://www.securityfocus.com/archive/1/540783/30/0/threaded",
              "refsource": "CONFIRM",
              "url": "http://www.securityfocus.com/archive/1/540783/30/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2017-4997",
    "datePublished": "2017-06-29T17:00:00",
    "dateReserved": "2016-12-29T00:00:00",
    "dateUpdated": "2024-08-05T14:47:44.121Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1183 (GCVE-0-2018-1183)
Vulnerability from cvelistv5
Published
2018-04-30 20:00
Modified
2024-09-16 17:58
Severity ?
CWE
  • XXE injection vulnerability
Summary
In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to 8.4.0.6, Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347, Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231, Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231, Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0, Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225, Dell EMC VNXe3200 Operating Environment (OE) all versions, Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228, Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) all versions, Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 (only if using Dell EMC Host Interface for Windows), Dell EMC ViPR SRM versions 4.0, 4.0.1, 4.0.2, 4.0.3 (only if using Dell EMC Host Interface for Windows), Dell EMC XtremIO versions 4.x, Dell EMC VMAX eNAS version 8.x, Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968, ECOM is affected by a XXE injection vulnerability due to the configuration of the XML parser shipped with the product. XXE Injection attack may occur when XML input containing a reference to an external entity (defined by the attacker) is processed by an affected XML parser. XXE Injection may allow attackers to gain unauthorized access to files containing sensitive information or may be used to cause denial-of-service.
References
http://seclists.org/fulldisclosure/2018/Apr/61 mailing-list, x_refsource_FULLDISC
http://www.securityfocus.com/bid/104024 vdb-entry, x_refsource_BID
Impacted products
Vendor Product Version
Dell EMC Dell EMC Unisphere for VMAX Virtual Appliance, Dell EMC Solutions Enabler Virtual Appliance, Dell EMC VASA Provider Virtual Appliance, Dell EMC SMIS, Dell EMC VMAX Embedded Management (eManagement), Dell EMC VNX2 Operating Environment (OE) for File, Dell EMC VNX2 Operating Environment (OE) for Block, Dell EMC VNX1 Operating Environment (OE) for File, Dell EMC VNX1 Operating Environment (OE) for Block, Dell EMC VNXe3200 Operating Environment (OE), Dell EMC VNXe1600 Operating Environment (OE), Dell EMC VNXe 3100/3150/3300 Operating Environment (OE), Dell EMC ViPR SRM, Dell EMC ViPR SRM, Dell EMC XtremIO, Dell EMC VMAX eNAS, Dell EMC Unity Operating Environment (OE) Version: Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to 8.4.0.6, Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347, Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231, Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231, Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0, Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225, Dell EMC VNXe3200 Operating Environment (OE) all versions, Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228, Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) all versions, Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 (only if using Dell EMC Host Interface for Windows), Dell EMC ViPR SRM versions ...[truncated*]
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:51:49.021Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20180425 DSA-2018-013: Dell EMC ECOM XML External Entity Injection Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2018/Apr/61"
          },
          {
            "name": "104024",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104024"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Dell EMC Unisphere for VMAX Virtual Appliance, Dell EMC Solutions Enabler Virtual Appliance, Dell EMC VASA Provider Virtual Appliance, Dell EMC SMIS, Dell EMC VMAX Embedded Management (eManagement), Dell EMC VNX2 Operating Environment (OE) for File, Dell EMC VNX2 Operating Environment (OE) for Block, Dell EMC VNX1 Operating Environment (OE) for File, Dell EMC VNX1 Operating Environment (OE) for Block, Dell EMC VNXe3200 Operating Environment (OE), Dell EMC VNXe1600 Operating Environment (OE), Dell EMC VNXe 3100/3150/3300 Operating Environment (OE), Dell EMC ViPR SRM, Dell EMC ViPR SRM, Dell EMC XtremIO, Dell EMC VMAX eNAS, Dell EMC Unity Operating Environment (OE)",
          "vendor": "Dell EMC",
          "versions": [
            {
              "status": "affected",
              "version": "Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to 8.4.0.6, Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347, Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231, Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231, Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0, Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225, Dell EMC VNXe3200 Operating Environment (OE) all versions, Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228, Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) all versions, Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 (only if using Dell EMC Host Interface for Windows), Dell EMC ViPR SRM versions  ...[truncated*]"
            }
          ]
        }
      ],
      "datePublic": "2018-04-25T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to 8.4.0.6, Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347, Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231, Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231, Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0, Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225, Dell EMC VNXe3200 Operating Environment (OE) all versions, Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228, Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) all versions, Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 (only if using Dell EMC Host Interface for Windows), Dell EMC ViPR SRM versions 4.0, 4.0.1, 4.0.2, 4.0.3 (only if using Dell EMC Host Interface for Windows), Dell EMC XtremIO versions 4.x, Dell EMC VMAX eNAS version 8.x, Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968, ECOM is affected by a XXE injection vulnerability due to the configuration of the XML parser shipped with the product. XXE Injection attack may occur when XML input containing a reference to an external entity (defined by the attacker) is processed by an affected XML parser. XXE Injection may allow attackers to gain unauthorized access to files containing sensitive information or may be used to cause denial-of-service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "XXE injection vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-05-01T09:57:01",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "name": "20180425 DSA-2018-013: Dell EMC ECOM XML External Entity Injection Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2018/Apr/61"
        },
        {
          "name": "104024",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104024"
        }
      ],
      "x_ConverterErrors": {
        "version_name": {
          "error": "version_name too long. Use array of versions to record more than one version.",
          "message": "Truncated!"
        }
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security_alert@emc.com",
          "DATE_PUBLIC": "2018-04-25T00:00:00",
          "ID": "CVE-2018-1183",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Dell EMC Unisphere for VMAX Virtual Appliance, Dell EMC Solutions Enabler Virtual Appliance, Dell EMC VASA Provider Virtual Appliance, Dell EMC SMIS, Dell EMC VMAX Embedded Management (eManagement), Dell EMC VNX2 Operating Environment (OE) for File, Dell EMC VNX2 Operating Environment (OE) for Block, Dell EMC VNX1 Operating Environment (OE) for File, Dell EMC VNX1 Operating Environment (OE) for Block, Dell EMC VNXe3200 Operating Environment (OE), Dell EMC VNXe1600 Operating Environment (OE), Dell EMC VNXe 3100/3150/3300 Operating Environment (OE), Dell EMC ViPR SRM, Dell EMC ViPR SRM, Dell EMC XtremIO, Dell EMC VMAX eNAS, Dell EMC Unity Operating Environment (OE)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to 8.4.0.6, Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347, Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231, Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231, Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0, Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225, Dell EMC VNXe3200 Operating Environment (OE) all versions, Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228, Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) all versions, Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 (only if using Dell EMC Host Interface for Windows), Dell EMC ViPR SRM versions 4.0, 4.0.1, 4.0.2, 4.0.3 (only if using Dell EMC Host Interface for Windows), Dell EMC XtremIO versions 4.x, Dell EMC VMAX eNAS version 8.x, Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Dell EMC"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to 8.4.0.6, Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347, Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231, Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231, Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0, Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225, Dell EMC VNXe3200 Operating Environment (OE) all versions, Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228, Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) all versions, Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 (only if using Dell EMC Host Interface for Windows), Dell EMC ViPR SRM versions 4.0, 4.0.1, 4.0.2, 4.0.3 (only if using Dell EMC Host Interface for Windows), Dell EMC XtremIO versions 4.x, Dell EMC VMAX eNAS version 8.x, Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968, ECOM is affected by a XXE injection vulnerability due to the configuration of the XML parser shipped with the product. XXE Injection attack may occur when XML input containing a reference to an external entity (defined by the attacker) is processed by an affected XML parser. XXE Injection may allow attackers to gain unauthorized access to files containing sensitive information or may be used to cause denial-of-service."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "XXE injection vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20180425 DSA-2018-013: Dell EMC ECOM XML External Entity Injection Vulnerability",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2018/Apr/61"
            },
            {
              "name": "104024",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104024"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2018-1183",
    "datePublished": "2018-04-30T20:00:00Z",
    "dateReserved": "2017-12-06T00:00:00",
    "dateUpdated": "2024-09-16T17:58:56.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd
Published
2023-01-18 15:15
Modified
2024-11-21 07:28
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain an information disclosure vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to read arbitrary files on the underlying file system.
References
security_alert@emc.comhttps://www.dell.com/support/kbdoc/en-us/000207177/dsa-2022-340-dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilitiesPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.dell.com/support/kbdoc/en-us/000207177/dsa-2022-340-dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilitiesPatch, Vendor Advisory
Impacted products
Vendor Product Version
dell emc_solutions_enabler_virtual_appliance *
dell emc_unisphere_for_powermax *
dell emc_unisphere_for_powermax *
dell emc_unisphere_for_powermax_virtual_appliance *
dell emc_vasa_provider_virtual_appliance *
dell solutions_enabler *
dell solutions_enabler *
dell unisphere_360 *
dell vasa_provider *
dell powermax_os -
dell powermax_os 5978


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dell:emc_solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8387C0A6-5B08-4ED3-94C9-3F6A0D2FD663",
              "versionEndExcluding": "9.2.3.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_unisphere_for_powermax:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "90943C0A-23EE-4FF4-82FE-B095B4F7F647",
              "versionEndExcluding": "9.2.3.22",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_unisphere_for_powermax:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CBCE9AB3-9796-4F15-AC46-6209E85C98BF",
              "versionEndExcluding": "10.0.0.5",
              "versionStartIncluding": "10.0.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D79BF436-665F-4D1E-963C-1EE7C87CC1E5",
              "versionEndExcluding": "9.2.3.22",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vasa_provider_virtual_appliance:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2B03A15-20F8-4A9D-8EE5-873B0A85ED1E",
              "versionEndExcluding": "9.2.4.15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "27D9AEC0-7614-4E79-BAF7-36939780DA12",
              "versionEndExcluding": "9.2.3.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "34ECB10B-FB47-4B2D-8629-DCAD9D46E630",
              "versionEndExcluding": "10.0.0.5",
              "versionStartIncluding": "10.0.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:unisphere_360:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD8C2F65-AFDA-4B55-ABE6-CFDBA027F66A",
              "versionEndExcluding": "9.2.3.12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:vasa_provider:*:*:*:*:standalone:*:*:*",
              "matchCriteriaId": "CDC05F62-AC66-4CC2-85DA-E7DFCE645FDF",
              "versionEndExcluding": "9.2.4.22",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:dell:powermax_os:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "053A6C03-0833-4F96-9D5F-466A5B9DB84B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:dell:powermax_os:5978:*:*:*:*:*:*:*",
              "matchCriteriaId": "43696C46-48E8-43E4-9387-77CE1B2BD401",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "\nDell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain an information disclosure vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to read arbitrary files on the underlying file system.\n\n\n\n\n\n"
    },
    {
      "lang": "es",
      "value": "Las versiones 9.2.3.x de Dell Unisphere para PowerMax vApp, VASA Provider vApp y Solution Enabler vApp versi\u00f3n 9.2.3.x contienen una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n. Un atacante remoto con pocos privilegios podr\u00eda explotar esta vulnerabilidad, lo que llevar\u00eda a leer archivos arbitrarios en el sistema de archivos subyacente."
    }
  ],
  "id": "CVE-2022-45103",
  "lastModified": "2024-11-21T07:28:47.307",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security_alert@emc.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-01-18T15:15:11.313",
  "references": [
    {
      "source": "security_alert@emc.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.dell.com/support/kbdoc/en-us/000207177/dsa-2022-340-dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.dell.com/support/kbdoc/en-us/000207177/dsa-2022-340-dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities"
    }
  ],
  "sourceIdentifier": "security_alert@emc.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security_alert@emc.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2017-06-29 17:29
Modified
2025-04-20 01:37
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
EMC VASA Provider Virtual Appliance versions 8.3.x and prior has an unauthenticated remote code execution vulnerability that could potentially be exploited by malicious users to compromise the affected system.
References
security_alert@emc.comhttp://www.securityfocus.com/archive/1/540783/30/0/threadedThird Party Advisory, VDB Entry
security_alert@emc.comhttp://www.securityfocus.com/bid/99169Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/540783/30/0/threadedThird Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/99169Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
dell emc_vasa_provider_virtual_appliance *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dell:emc_vasa_provider_virtual_appliance:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "00B23FCA-20E2-4937-92A4-0EAE7AC70771",
              "versionEndIncluding": "8.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "EMC VASA Provider Virtual Appliance versions 8.3.x and prior has an unauthenticated remote code execution vulnerability that could potentially be exploited by malicious users to compromise the affected system."
    },
    {
      "lang": "es",
      "value": "Las versiones  8.3.x y anteriores de EMC VASA Provider Virtual Appliance contienen una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo no autenticado que podr\u00eda ser explotada por usuarios maliciosos con el fin de comprometer el sistema afectado."
    }
  ],
  "id": "CVE-2017-4997",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-06-29T17:29:00.447",
  "references": [
    {
      "source": "security_alert@emc.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/archive/1/540783/30/0/threaded"
    },
    {
      "source": "security_alert@emc.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/99169"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/archive/1/540783/30/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/99169"
    }
  ],
  "sourceIdentifier": "security_alert@emc.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2018-04-30 20:29
Modified
2024-11-21 03:59
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to 8.4.0.6, Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347, Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231, Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231, Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0, Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225, Dell EMC VNXe3200 Operating Environment (OE) all versions, Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228, Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) all versions, Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 (only if using Dell EMC Host Interface for Windows), Dell EMC ViPR SRM versions 4.0, 4.0.1, 4.0.2, 4.0.3 (only if using Dell EMC Host Interface for Windows), Dell EMC XtremIO versions 4.x, Dell EMC VMAX eNAS version 8.x, Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968, ECOM is affected by a XXE injection vulnerability due to the configuration of the XML parser shipped with the product. XXE Injection attack may occur when XML input containing a reference to an external entity (defined by the attacker) is processed by an affected XML parser. XXE Injection may allow attackers to gain unauthorized access to files containing sensitive information or may be used to cause denial-of-service.
References
security_alert@emc.comhttp://seclists.org/fulldisclosure/2018/Apr/61Mailing List, Third Party Advisory
security_alert@emc.comhttp://www.securityfocus.com/bid/104024Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2018/Apr/61Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/104024Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
dell emc_smis *
dell emc_solutions_enabler_virtual_appliance *
dell emc_unisphere *
dell emc_unity_operating_environment *
dell emc_vasa_provider_virtual_appliance *
dell emc_vipr_srm -
dell emc_vipr_srm 3.7
dell emc_vipr_srm 3.7.1
dell emc_vipr_srm 3.7.2
dell emc_vipr_srm 4.0
dell emc_vipr_srm 4.0.1
dell emc_vipr_srm 4.0.2
dell emc_vipr_srm 4.0.3
dell emc_vmax_embedded_management *
dell emc_vmax_enas 8.0
dell emc_vmax_enas 8.0.1
dell emc_vnx1_operating_environment 05.32.000.5.225
dell emc_vnx1_operating_environment 7.1.82.0
dell emc_vnx2_operating_environment *
dell emc_vnx2_operating_environment *
dell emc_vnxe_3100_operating_environment -
dell emc_vnxe_3150_operating_environment -
dell emc_vnxe_3300__operating_environment -
dell emc_vnxe1600_operating_environment *
dell emc_vnxe3200_operating_environment -
dell emc_xtremio 4.0
dell emc_xtremio 4.0.2


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dell:emc_smis:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C4890CC-B6AF-4293-940B-6BA7A343AE0D",
              "versionEndExcluding": "8.4.0.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "02910BB4-7375-4399-8DFF-71CD44DDB5D7",
              "versionEndExcluding": "8.4.0.8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_unisphere:*:*:*:*:*:vmax_virtual_appliance:*:*",
              "matchCriteriaId": "1A7DB792-1195-4B12-997A-71FFCDC5BD12",
              "versionEndExcluding": "8.4.0.8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_unity_operating_environment:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "40F0B685-3F39-4B78-925A-19ACF20E0114",
              "versionEndExcluding": "4.3.0.1522077968",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vasa_provider_virtual_appliance:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5BFACF5C-7D38-4BDA-92FD-D40404BF1A26",
              "versionEndExcluding": "8.4.0.512",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vipr_srm:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "953D0732-6869-47A1-9A1D-B3D844E63120",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vipr_srm:3.7:*:*:*:*:windows:*:*",
              "matchCriteriaId": "09ABC7C3-26EF-4D27-B814-C5EA8107C7BF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vipr_srm:3.7.1:*:*:*:*:windows:*:*",
              "matchCriteriaId": "532479F9-83DC-47AC-B816-AA614447237E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vipr_srm:3.7.2:*:*:*:*:windows:*:*",
              "matchCriteriaId": "9D84812B-06DE-4362-830F-0997EC260B4B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vipr_srm:4.0:*:*:*:*:windows:*:*",
              "matchCriteriaId": "1A669D38-8405-4A53-BF27-9D005D968CC0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vipr_srm:4.0.1:*:*:*:*:windows:*:*",
              "matchCriteriaId": "C218A6C6-82A1-498B-B2E4-187031A2CC2B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vipr_srm:4.0.2:*:*:*:*:windows:*:*",
              "matchCriteriaId": "369181DA-D10C-45C9-B3FA-115FE8D8D190",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vipr_srm:4.0.3:*:*:*:*:windows:*:*",
              "matchCriteriaId": "0F448089-C90D-4EE4-BD6D-6757D13E6471",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vmax_embedded_management:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A3549BA-CAF3-45A8-B7A9-508330EB5208",
              "versionEndIncluding": "1.4.0.347",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vmax_enas:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "B755E0BF-FB16-449B-827C-B2552621A141",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vmax_enas:8.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9AB5710-44B2-43A9-8715-33E855002809",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vnx1_operating_environment:05.32.000.5.225:*:*:*:*:block:*:*",
              "matchCriteriaId": "E9EF3C50-4085-4BF5-9219-690115AD8467",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vnx1_operating_environment:7.1.82.0:*:*:*:*:file:*:*",
              "matchCriteriaId": "F9B59471-BBB6-443A-9450-08121701267F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vnx2_operating_environment:*:*:*:*:*:block:*:*",
              "matchCriteriaId": "5DCD4467-C1DF-455E-B079-F0A52991A818",
              "versionEndExcluding": "05.33.009.5.231",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vnx2_operating_environment:*:*:*:*:*:file:*:*",
              "matchCriteriaId": "EB4C5340-CAD6-40FC-A0C4-1116150C5A0E",
              "versionEndExcluding": "8.1.9.231",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vnxe_3100_operating_environment:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9CFCEFE2-675E-4081-9EC6-15B8E24B9F6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vnxe_3150_operating_environment:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "98673570-1E9C-4452-8B37-29D5E9ED2C7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vnxe_3300__operating_environment:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DCA77A62-9B38-41B6-B472-419B6CCA9FEB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vnxe1600_operating_environment:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C76DD84-7211-4E0E-AFF7-3471267FE511",
              "versionEndExcluding": "3.1.9.9570228",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_vnxe3200_operating_environment:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "97C1ABE7-47C2-4DA2-921A-E6A432EECCE5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_xtremio:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "05CAC762-BF62-4D54-8505-2052FD800201",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_xtremio:4.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "90F3C198-E9B7-4D6E-817A-C413DD5B54DD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to 8.4.0.6, Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347, Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231, Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231, Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0, Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225, Dell EMC VNXe3200 Operating Environment (OE) all versions, Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228, Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) all versions, Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 (only if using Dell EMC Host Interface for Windows), Dell EMC ViPR SRM versions 4.0, 4.0.1, 4.0.2, 4.0.3 (only if using Dell EMC Host Interface for Windows), Dell EMC XtremIO versions 4.x, Dell EMC VMAX eNAS version 8.x, Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968, ECOM is affected by a XXE injection vulnerability due to the configuration of the XML parser shipped with the product. XXE Injection attack may occur when XML input containing a reference to an external entity (defined by the attacker) is processed by an affected XML parser. XXE Injection may allow attackers to gain unauthorized access to files containing sensitive information or may be used to cause denial-of-service."
    },
    {
      "lang": "es",
      "value": "En Dell EMC Unisphere for VMAX Virtual Appliance en versiones anteriores a la 8.4.0.8; Dell EMC Solutions Enabler Virtual Appliance en versiones anteriores a la 8.4.0.8; Dell EMC VASA Provider Virtual Appliance en versiones anteriores a la 8.4.0.512; Dell EMC SMIS en versiones anteriores a la 8.4.0.6; Dell EMC VMAX Embedded Management (eManagement) en versiones anteriores, e incluyendo, la 1.4.0.347; Dell EMC VNX2 Operating Environment (OE) for File en versiones anteriores a la 8.1.9.231; Dell EMC VNX2 Operating Environment (OE) for Block en versiones anteriores a la 05.33.009.5.231; Dell EMC VNX1 Operating Environment (OE) for File en versiones anteriores a la 7.1.82.0; Dell EMC VNX1 Operating Environment (OE) for Block en versiones anteriores a la 05.32.000.5.225; Dell EMC VNXe3200 Operating Environment (OE) en todas las versiones; Dell EMC VNXe1600 Operating Environment (OE) en versiones anteriores a la 3.1.9.9570228; Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) en todas las versiones, Dell EMC ViPR SRM en versiones 3.7, 3.7.1 y 3.7.2 (solo si se usa Dell EMC Host Interface for Windows); Dell EMC ViPR SRM en versiones 4.0, 4.0.1, 4.0.2 y 4.0.3 (solo si se usa Dell EMC Host Interface for Windows); Dell EMC XtremIO en versiones 4.x; Dell EMC VMAX eNAS en versiones 8.x y Dell EMC Unity Operating Environment (OE) en versiones anteriores a la 4.3.0.1522077968, ECOM se ha visto afectado por una vulnerabilidad de XEE (XML External Entity) debido a la configuraci\u00f3n del analizador de XML distribuido con el producto. Podr\u00eda ocurrir un ataque de inyecci\u00f3n XEE cuando las entradas que contienen una referencia a una entidad externa (definida por un atacante) son procesadas por un analizador XML afectado. La inyecci\u00f3n XEE podr\u00eda permitir que los atacantes obtengan acceso no autorizado a los archivos que contienen informaci\u00f3n sensible o que podr\u00edan emplearse para provocar una denegaci\u00f3n de servicio (DoS)."
    }
  ],
  "id": "CVE-2018-1183",
  "lastModified": "2024-11-21T03:59:21.123",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": true,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-04-30T20:29:00.310",
  "references": [
    {
      "source": "security_alert@emc.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://seclists.org/fulldisclosure/2018/Apr/61"
    },
    {
      "source": "security_alert@emc.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/104024"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://seclists.org/fulldisclosure/2018/Apr/61"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/104024"
    }
  ],
  "sourceIdentifier": "security_alert@emc.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}