CVE-2018-11076 Dell EMC Avamar and Integrated Data Protection Appliance Information Exposure Vulnerability
MediumCVSS 6.5
EPSS 0.83%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0 and 7.4.1 and Dell EMC Integrated Data Protection Appliance (IDPA) 2.0 are affected by an information exposure vulnerability. Avamar Java management console's SSL/TLS private key may be leaked in the Avamar Java management client package. The private key could potentially be used by an unauthenticated attacker on the same data-link layer to initiate a MITM attack on management console users.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Dell emc avamar | = 7.2.0 | No fix listed |
| Dell emc avamar | = 7.2.1 | No fix listed |
| Dell emc avamar | = 7.3.0 | No fix listed |
| Dell emc avamar | = 7.3.1 | No fix listed |
| Dell emc avamar | = 7.4.0 | No fix listed |
| Dell emc avamar | = 7.4.1 | No fix listed |
| Dell emc integrated data protection appliance | = 2.0 | No fix listed |
| VMware vsphere data protection | = 6.0.0 | No fix listed |
| VMware vsphere data protection | = 6.0.1 | No fix listed |
| VMware vsphere data protection | = 6.0.2 | No fix listed |
| VMware vsphere data protection | = 6.0.3 | No fix listed |
| VMware vsphere data protection | = 6.0.4 | No fix listed |
| VMware vsphere data protection | = 6.0.5 | No fix listed |
| VMware vsphere data protection | = 6.0.6 | No fix listed |
| VMware vsphere data protection | = 6.0.7 | No fix listed |
| VMware vsphere data protection | = 6.0.8 | No fix listed |
| VMware vsphere data protection | = 6.1.0 | No fix listed |
| VMware vsphere data protection | = 6.1.1 | No fix listed |
| VMware vsphere data protection | = 6.1.2 | No fix listed |
| VMware vsphere data protection | = 6.1.3 | No fix listed |
| VMware vsphere data protection | = 6.1.4 | No fix listed |
| VMware vsphere data protection | = 6.1.5 | No fix listed |
| VMware vsphere data protection | = 6.1.6 | No fix listed |
| VMware vsphere data protection | = 6.1.7 | No fix listed |
| VMware vsphere data protection | = 6.1.8 | No fix listed |
Show 8 more
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware vsphere data protection | = 6.1.9 | No fix listed |
| Dell EMC Avamar | = 7.2.0 | No fix listed |
| Dell EMC Avamar | = 7.2.1 | No fix listed |
| Dell EMC Avamar | = 7.3.0 | No fix listed |
| Dell EMC Avamar | = 7.3.1 | No fix listed |
| Dell EMC Avamar | = 7.4.0 | No fix listed |
| Dell EMC Avamar | = 7.4.1 | No fix listed |
| Dell EMC Integrated Data Protection Appliance | = 2.0 | No fix listed |
References
- 105972 third-party-advisory vdb-entry
- 1042153 third-party-advisory vdb-entry
- 20181120 DSA-2018-154: Dell EMC Avamar and Integrated Data Protection Appliance Information Exposure Vulnerability mailing-list third-party-advisory
- www.vmware.com patch third-party-advisory