Vulnerability CVE-2017-10949
Published: 2017-08-04

Description:
Directory Traversal in Dell Storage Manager 2016 R2.1 causes Information Disclosure when the doGet method of the EmWebsiteServlet class doesn't properly validate user provided path before using it in file operations. Was ZDI-CAN-4459.

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
DELL -> Storage manager 2016 

 References:
http://topics-cdn.dell.com/pdf/dell-compellent-sc8000_release%20notes24_en-us.pdf
http://www.securityfocus.com/bid/100138
http://www.zerodayinitiative.com/advisories/ZDI-17-523
Copyright 2024, cxsecurity.com

 

Back to Top