Details of VAR-201711-1009

ID

VAR-201711-1009

CVE

CVE-2017-8194

TITLE

FusionSphere OpenStack Authentication vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-010574

DESCRIPTION

The FusionSphere OpenStack V100R006C00SPC102(NFV) has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message. FusionSphere OpenStack Contains an authentication vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Attackers can exploit this issue to bypass the authentication mechanism. Huawei FusionSphere OpenStack is a set of cloud platform software for FusionSphere (cloud operating system) of Huawei in China in ICT scenarios

Trust: 1.98

sources: NVD: CVE-2017-8194 // JVNDB: JVNDB-2017-010574 // BID: 102209 // VULHUB: VHN-116397

AFFECTED PRODUCTS

vendor:	huawei	model:	fusionsphere openstack	scope:	eq	version:	v100r006c00spc102\(nfv\)	Trust: 1.6
vendor:	huawei	model:	fusionsphere openstack	scope:	eq	version:	v100r006c00spc102 (nfv)	Trust: 0.8
vendor:	huawei	model:	fusionsphere openstack v100r006c00spc102	scope:	-	version:	-	Trust: 0.3
vendor:	huawei	model:	fusionsphere openstack v100r006c10spc100	scope:	ne	version:	-	Trust: 0.3

sources: BID: 102209 // JVNDB: JVNDB-2017-010574 // CNNVD: CNNVD-201711-944 // NVD: CVE-2017-8194

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-8194
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-8194
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201711-944
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-116397
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-8194
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-116397
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-8194
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-116397 // JVNDB: JVNDB-2017-010574 // CNNVD: CNNVD-201711-944 // NVD: CVE-2017-8194

PROBLEMTYPE DATA

problemtype:

CWE-287

Trust: 1.9

sources: VULHUB: VHN-116397 // JVNDB: JVNDB-2017-010574 // NVD: CVE-2017-8194

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201711-944

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201711-944

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-010574

PATCH

title:	huawei-sa-20170830-02-OpenStack	url:	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170830-02-OpenStack-en	Trust: 0.8
title:	Huawei FusionSphere OpenStack Remediation measures for authorization problem vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=76654	Trust: 0.6

sources: JVNDB: JVNDB-2017-010574 // CNNVD: CNNVD-201711-944

EXTERNAL IDS

db:	NVD	id:	CVE-2017-8194	Trust: 2.8
db:	BID	id:	102209	Trust: 1.4
db:	JVNDB	id:	JVNDB-2017-010574	Trust: 0.8
db:	CNNVD	id:	CNNVD-201711-944	Trust: 0.7
db:	VULHUB	id:	VHN-116397	Trust: 0.1

sources: VULHUB: VHN-116397 // BID: 102209 // JVNDB: JVNDB-2017-010574 // CNNVD: CNNVD-201711-944 // NVD: CVE-2017-8194

REFERENCES

url:	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170830-02-openstack-en	Trust: 2.0
url:	http://www.securityfocus.com/bid/102209	Trust: 1.1
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8194	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8194	Trust: 0.8
url:	http://www.huawei.com	Trust: 0.3

sources: VULHUB: VHN-116397 // BID: 102209 // JVNDB: JVNDB-2017-010574 // CNNVD: CNNVD-201711-944 // NVD: CVE-2017-8194

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 102209

SOURCES

db:	VULHUB	id:	VHN-116397
db:	BID	id:	102209
db:	JVNDB	id:	JVNDB-2017-010574
db:	CNNVD	id:	CNNVD-201711-944
db:	NVD	id:	CVE-2017-8194

LAST UPDATE DATE

2025-04-20T23:39:55.770000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-116397	date:	2017-12-20T00:00:00
db:	BID	id:	102209	date:	2017-12-19T21:01:00
db:	JVNDB	id:	JVNDB-2017-010574	date:	2017-12-19T00:00:00
db:	CNNVD	id:	CNNVD-201711-944	date:	2017-11-23T00:00:00
db:	NVD	id:	CVE-2017-8194	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-116397	date:	2017-11-22T00:00:00
db:	BID	id:	102209	date:	2017-08-30T00:00:00
db:	JVNDB	id:	JVNDB-2017-010574	date:	2017-12-19T00:00:00
db:	CNNVD	id:	CNNVD-201711-944	date:	2017-11-23T00:00:00
db:	NVD	id:	CVE-2017-8194	date:	2017-11-22T19:29:04.787