CVE-2018-15771 - Vulnerability Details - OpenCVE

Dell EMC RecoverPoint versions prior to 5.1.2.1 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an information disclosure vulnerability. A malicious boxmgmt user may potentially be able to determine the existence of any system file via Boxmgmt CLI.

No CVSS v4.0

No CVSS v3.1

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00091.

Key SSVC decision points have not yet been added.

Vendors	Products
Emc	Recoverpoint Recoverpoint For Virtual Machines

Configuration 1 [-]

OR	cpe:2.3:a:emc:recoverpoint::::::::
	cpe:2.3:a:emc:recoverpoint_for_virtual_machines::::::::

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2018-7634	Dell EMC RecoverPoint versions prior to 5.1.2.1 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an information disclosure vulnerability. A malicious boxmgmt user may potentially be able to determine the existence of any system file via Boxmgmt CLI.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://www.securityfocus.com/bid/105916
http://www.securitytracker.com/id/1042059
https://seclists.org/fulldisclosure/2018/Nov/34

History

No history.

MITRE

Status: PUBLISHED

Assigner: dell

Published: 2018-11-13T14:00:00Z

Updated: 2024-09-17T03:58:36.708Z

Reserved: 2018-08-23T00:00:00

Link: CVE-2018-15771

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-11-13T14:29:00.260

Modified: 2024-11-21T03:51:26.387

Link: CVE-2018-15771

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Dell EMC RecoverPoint", "vendor": "Dell EMC", "versions": [{"lessThan": "5.1.2.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Dell EMC RecoverPoint Virtual Machine (VM)", "vendor": "Dell EMC", "versions": [{"lessThan": "5.2.0.2", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2018-11-09T00:00:00", "descriptions": [{"lang": "en", "value": "Dell EMC RecoverPoint versions prior to 5.1.2.1 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an information disclosure vulnerability. A malicious boxmgmt user may potentially be able to determine the existence of any system file via Boxmgmt CLI."}], "problemTypes": [{"descriptions": [{"description": "information disclosure vulnerability", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-11-16T10:57:01", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"name": "1042059", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1042059"}, {"name": "105916", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/105916"}, {"name": "20181108 DSA-2018-205: Dell EMC RecoverPoint Multiple Vulnerabilities", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "https://seclists.org/fulldisclosure/2018/Nov/34"}], "source": {"discovery": "UNKNOWN"}, "title": "Dell EMC RecoverPoint Information Disclosure Vulnerability", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security_alert@emc.com", "DATE_PUBLIC": "2018-11-09T05:00:00.000Z", "ID": "CVE-2018-15771", "STATE": "PUBLIC", "TITLE": "Dell EMC RecoverPoint Information Disclosure Vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Dell EMC RecoverPoint", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_value": "5.1.2.1"}]}}, {"product_name": "Dell EMC RecoverPoint Virtual Machine (VM)", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_value": "5.2.0.2"}]}}]}, "vendor_name": "Dell EMC"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Dell EMC RecoverPoint versions prior to 5.1.2.1 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an information disclosure vulnerability. A malicious boxmgmt user may potentially be able to determine the existence of any system file via Boxmgmt CLI."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "information disclosure vulnerability"}]}]}, "references": {"reference_data": [{"name": "1042059", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1042059"}, {"name": "105916", "refsource": "BID", "url": "http://www.securityfocus.com/bid/105916"}, {"name": "20181108 DSA-2018-205: Dell EMC RecoverPoint Multiple Vulnerabilities", "refsource": "FULLDISC", "url": "https://seclists.org/fulldisclosure/2018/Nov/34"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T10:01:54.671Z"}, "title": "CVE Program Container", "references": [{"name": "1042059", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1042059"}, {"name": "105916", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/105916"}, {"name": "20181108 DSA-2018-205: Dell EMC RecoverPoint Multiple Vulnerabilities", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "https://seclists.org/fulldisclosure/2018/Nov/34"}]}]}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2018-15771", "datePublished": "2018-11-13T14:00:00Z", "dateReserved": "2018-08-23T00:00:00", "dateUpdated": "2024-09-17T03:58:36.708Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:emc:recoverpoint:*:*:*:*:*:*:*:*", "matchCriteriaId": "E4B6E3EB-CE56-4876-AB98-3A10A413209B", "versionEndExcluding": "5.1.2.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:emc:recoverpoint_for_virtual_machines:*:*:*:*:*:*:*:*", "matchCriteriaId": "BE7A791F-7425-4171-A07D-70A7AE67F1B6", "versionEndExcluding": "5.2.0.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Dell EMC RecoverPoint versions prior to 5.1.2.1 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an information disclosure vulnerability. A malicious boxmgmt user may potentially be able to determine the existence of any system file via Boxmgmt CLI."}, {"lang": "es", "value": "Dell EMC RecoverPoint, en versiones anteriores a la 5.1.2.1 y RecoverPoint for VMs en versiones anteriores a la 5.2.0.2, contienen una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n. Un usuario boxmgmt malicioso podr\u00eda ser capaz de determinar la existencia de cualquier sistema mediante la interfaz de l\u00ednea de comandos de Boxmgmt."}], "id": "CVE-2018-15771", "lastModified": "2024-11-21T03:51:26.387", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-11-13T14:29:00.260", "references": [{"source": "security_alert@emc.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/105916"}, {"source": "security_alert@emc.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1042059"}, {"source": "security_alert@emc.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://seclists.org/fulldisclosure/2018/Nov/34"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/105916"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1042059"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://seclists.org/fulldisclosure/2018/Nov/34"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}