Details of VAR-201704-0163

ID

VAR-201704-0163

CVE

CVE-2015-7270

TITLE

plural Dell iDRAC Path traversal vulnerability in products

Trust: 0.8

sources: JVNDB: JVNDB-2015-007494

DESCRIPTION

Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows directory traversal. Dell iDRAC6 , iDRAC7 and iDRAC8 Contains a path traversal vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) An attack may be carried out. Dell iDRAC is prone to a local directory-traversal vulnerability. Exploiting this issue will allow an attacker to gain sensitive information and perform unauthorized actions. The following products are vulnerable: Versions prior to Dell iDRAC6 2.80 Versions prior to Dell iDRAC7 2.21.21.21 Versions prior to Dell iDRAC8 2.21.21.21

Trust: 2.07

sources: NVD: CVE-2015-7270 // JVNDB: JVNDB-2015-007494 // BID: 97521 // VULHUB: VHN-85231 // VULMON: CVE-2015-7270

AFFECTED PRODUCTS

vendor:	dell	model:	integrated remote access controller	scope:	lte	version:	1.99	Trust: 1.0
vendor:	dell	model:	integrated remote access controller	scope:	lte	version:	2.20.20.20	Trust: 1.0
vendor:	dell	model:	idrac6	scope:	lt	version:	2.80	Trust: 0.8
vendor:	dell	model:	idrac7	scope:	lt	version:	2.21.21.21	Trust: 0.8
vendor:	dell	model:	idrac8	scope:	lt	version:	2.21.21.21	Trust: 0.8
vendor:	dell	model:	integrated remote access controller	scope:	eq	version:	2.20.20.20	Trust: 0.6
vendor:	dell	model:	integrated remote access controller	scope:	eq	version:	1.99	Trust: 0.6
vendor:	dell	model:	idrac8	scope:	eq	version:	0	Trust: 0.3
vendor:	dell	model:	idrac7	scope:	eq	version:	1.57.57	Trust: 0.3
vendor:	dell	model:	idrac7	scope:	eq	version:	1.56.55	Trust: 0.3
vendor:	dell	model:	idrac6	scope:	eq	version:	1.95	Trust: 0.3
vendor:	dell	model:	idrac6	scope:	eq	version:	1.7	Trust: 0.3
vendor:	dell	model:	idrac6	scope:	eq	version:	1.41	Trust: 0.3
vendor:	dell	model:	idrac8	scope:	ne	version:	2.21.21.21	Trust: 0.3
vendor:	dell	model:	idrac7	scope:	ne	version:	2.21.21.21	Trust: 0.3
vendor:	dell	model:	idrac6	scope:	ne	version:	2.80	Trust: 0.3

sources: BID: 97521 // JVNDB: JVNDB-2015-007494 // CNNVD: CNNVD-201704-467 // NVD: CVE-2015-7270

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-7270
value:	HIGH
Trust: 1.0
NVD:	CVE-2015-7270
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201704-467
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-85231
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2015-7270
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2015-7270
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-85231
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2015-7270
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-85231 // VULMON: CVE-2015-7270 // JVNDB: JVNDB-2015-007494 // CNNVD: CNNVD-201704-467 // NVD: CVE-2015-7270

PROBLEMTYPE DATA

problemtype:

CWE-22

Trust: 1.9

sources: VULHUB: VHN-85231 // JVNDB: JVNDB-2015-007494 // NVD: CVE-2015-7270

THREAT TYPE

local

Trust: 0.9

sources: BID: 97521 // CNNVD: CNNVD-201704-467

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-201704-467

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-007494

PATCH

title:	Dell iDRAC Response to CVE (Common Vulnerabilities and Exposures) ID CVE-2015-7270, 7271, 7272, 7273, 7274, and 7275 - 2 DEC 2015	url:	http://en.community.dell.com/techcenter/extras/m/white_papers/20441859	Trust: 0.8
title:	Dell Integrated Remote Access Controller 6 , 7 and 8 Repair measures for path traversal vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=73818	Trust: 0.6
title:	-	url:	https://github.com/chnzzh/iDRAC-CVE-lib	Trust: 0.1

sources: VULMON: CVE-2015-7270 // JVNDB: JVNDB-2015-007494 // CNNVD: CNNVD-201704-467

EXTERNAL IDS

db:	NVD	id:	CVE-2015-7270	Trust: 2.9
db:	BID	id:	97521	Trust: 1.5
db:	JVNDB	id:	JVNDB-2015-007494	Trust: 0.8
db:	CNNVD	id:	CNNVD-201704-467	Trust: 0.7
db:	VULHUB	id:	VHN-85231	Trust: 0.1
db:	VULMON	id:	CVE-2015-7270	Trust: 0.1

sources: VULHUB: VHN-85231 // VULMON: CVE-2015-7270 // BID: 97521 // JVNDB: JVNDB-2015-007494 // CNNVD: CNNVD-201704-467 // NVD: CVE-2015-7270

REFERENCES

url:	http://en.community.dell.com/techcenter/extras/m/white_papers/20441859	Trust: 2.1
url:	http://www.securityfocus.com/bid/97521	Trust: 1.3
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7270	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2015-7270	Trust: 0.8
url:	http://dell.com	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/22.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://github.com/chnzzh/idrac-cve-lib	Trust: 0.1

sources: VULHUB: VHN-85231 // VULMON: CVE-2015-7270 // BID: 97521 // JVNDB: JVNDB-2015-007494 // CNNVD: CNNVD-201704-467 // NVD: CVE-2015-7270

CREDITS

Google Infrastructure Security Assurance

Trust: 0.3

sources: BID: 97521

SOURCES

db:	VULHUB	id:	VHN-85231
db:	VULMON	id:	CVE-2015-7270
db:	BID	id:	97521
db:	JVNDB	id:	JVNDB-2015-007494
db:	CNNVD	id:	CNNVD-201704-467
db:	NVD	id:	CVE-2015-7270

LAST UPDATE DATE

2025-04-20T23:05:15.018000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-85231	date:	2017-04-14T00:00:00
db:	VULMON	id:	CVE-2015-7270	date:	2017-04-14T00:00:00
db:	BID	id:	97521	date:	2017-04-11T00:04:00
db:	JVNDB	id:	JVNDB-2015-007494	date:	2017-05-15T00:00:00
db:	CNNVD	id:	CNNVD-201704-467	date:	2017-08-31T00:00:00
db:	NVD	id:	CVE-2015-7270	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-85231	date:	2017-04-10T00:00:00
db:	VULMON	id:	CVE-2015-7270	date:	2017-04-10T00:00:00
db:	BID	id:	97521	date:	2017-04-09T00:00:00
db:	JVNDB	id:	JVNDB-2015-007494	date:	2017-05-15T00:00:00
db:	CNNVD	id:	CNNVD-201704-467	date:	2017-04-09T00:00:00
db:	NVD	id:	CVE-2015-7270	date:	2017-04-10T03:59:00.747