CVE-2018-11077 Dell EMC Avamar and Integrated Data Protection Appliance Command Injection Vulnerability
MediumCVSS 6.7
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
'getlogs' utility in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1 and 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 is affected by an OS command injection vulnerability. A malicious Avamar admin user may potentially be able to execute arbitrary commands under root privilege.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Dell emc avamar | = 7.2.0 | No fix listed |
| Dell emc avamar | = 7.2.1 | No fix listed |
| Dell emc avamar | = 7.3.0 | No fix listed |
| Dell emc avamar | = 7.3.1 | No fix listed |
| Dell emc avamar | = 7.4.0 | No fix listed |
| Dell emc avamar | = 7.4.1 | No fix listed |
| Dell emc avamar | = 7.5.0 | No fix listed |
| Dell emc avamar | = 7.5.1 | No fix listed |
| Dell emc avamar | = 18.1 | No fix listed |
| Dell emc integrated data protection appliance | = 2.0 | No fix listed |
| Dell emc integrated data protection appliance | = 2.1 | No fix listed |
| Dell emc integrated data protection appliance | = 2.2 | No fix listed |
| VMware vsphere data protection | = 6.0.0 | No fix listed |
| VMware vsphere data protection | = 6.0.1 | No fix listed |
| VMware vsphere data protection | = 6.0.2 | No fix listed |
| VMware vsphere data protection | = 6.0.3 | No fix listed |
| VMware vsphere data protection | = 6.0.4 | No fix listed |
| VMware vsphere data protection | = 6.0.5 | No fix listed |
| VMware vsphere data protection | = 6.0.6 | No fix listed |
| VMware vsphere data protection | = 6.0.7 | No fix listed |
| VMware vsphere data protection | = 6.0.8 | No fix listed |
| VMware vsphere data protection | = 6.1.0 | No fix listed |
| VMware vsphere data protection | = 6.1.1 | No fix listed |
| VMware vsphere data protection | = 6.1.2 | No fix listed |
| VMware vsphere data protection | = 6.1.3 | No fix listed |
Show 18 more
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware vsphere data protection | = 6.1.4 | No fix listed |
| VMware vsphere data protection | = 6.1.5 | No fix listed |
| VMware vsphere data protection | = 6.1.6 | No fix listed |
| VMware vsphere data protection | = 6.1.7 | No fix listed |
| VMware vsphere data protection | = 6.1.8 | No fix listed |
| VMware vsphere data protection | = 6.1.9 | No fix listed |
| Dell EMC Avamar | = 7.2.0 | No fix listed |
| Dell EMC Avamar | = 7.2.1 | No fix listed |
| Dell EMC Avamar | = 7.3.0 | No fix listed |
| Dell EMC Avamar | = 7.3.1 | No fix listed |
| Dell EMC Avamar | = 7.4.0 | No fix listed |
| Dell EMC Avamar | = 7.4.1 | No fix listed |
| Dell EMC Avamar | = 7.5.0 | No fix listed |
| Dell EMC Avamar | = 7.5.1 | No fix listed |
| Dell EMC Avamar | = 18.1 | No fix listed |
| Dell EMC Integrated Data Protection Appliance | = 2.0 | No fix listed |
| Dell EMC Integrated Data Protection Appliance | = 2.1 | No fix listed |
| Dell EMC Integrated Data Protection Appliance | = 2.2 | No fix listed |
References
- 105971 third-party-advisory vdb-entry
- 1042153 third-party-advisory vdb-entry
- 20181120 DSA-2018-155: Dell EMC Avamar and Integrated Data Protection Appliance Command Injection Vulnerability mailing-list third-party-advisory
- www.vmware.com patch third-party-advisory