Details of VAR-201804-0950

ID

VAR-201804-0950

CVE

CVE-2018-1183

TITLE

plural Dell EMC In product XML External entity vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2018-004978

DESCRIPTION

In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to 8.4.0.6, Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347, Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231, Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231, Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0, Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225, Dell EMC VNXe3200 Operating Environment (OE) all versions, Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228, Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) all versions, Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 (only if using Dell EMC Host Interface for Windows), Dell EMC ViPR SRM versions 4.0, 4.0.1, 4.0.2, 4.0.3 (only if using Dell EMC Host Interface for Windows), Dell EMC XtremIO versions 4.x, Dell EMC VMAX eNAS version 8.x, Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968, ECOM is affected by a XXE injection vulnerability due to the configuration of the XML parser shipped with the product. XXE Injection attack may occur when XML input containing a reference to an external entity (defined by the attacker) is processed by an affected XML parser. XXE Injection may allow attackers to gain unauthorized access to files containing sensitive information or may be used to cause denial-of-service. plural Dell EMC The product includes XML An external entity vulnerability exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. are all products of Dell in the United States. Dell EMC Unisphere for VMAX Virtual Appliance (vApp) is a management tool for VMAX storage arrays. EMC Solutions Enabler Virtual Appliance is a solution application virtual appliance

Trust: 1.98

sources: NVD: CVE-2018-1183 // JVNDB: JVNDB-2018-004978 // BID: 104024 // VULHUB: VHN-121728

AFFECTED PRODUCTS

vendor:	dell	model:	emc vipr srm	scope:	eq	version:	4.0.2	Trust: 1.6
vendor:	dell	model:	emc vipr srm	scope:	eq	version:	3.7.1	Trust: 1.6
vendor:	dell	model:	emc vmax enas	scope:	eq	version:	8.0	Trust: 1.6
vendor:	dell	model:	emc vipr srm	scope:	eq	version:	4.0	Trust: 1.6
vendor:	dell	model:	emc vipr srm	scope:	eq	version:	4.0.1	Trust: 1.6
vendor:	dell	model:	emc vipr srm	scope:	eq	version:	3.7	Trust: 1.6
vendor:	dell	model:	emc vipr srm	scope:	eq	version:	-	Trust: 1.6
vendor:	dell	model:	emc vipr srm	scope:	eq	version:	3.7.2	Trust: 1.6
vendor:	dell	model:	emc vipr srm	scope:	eq	version:	4.0.3	Trust: 1.6
vendor:	dell	model:	emc xtremio	scope:	eq	version:	4.0.2	Trust: 1.0
vendor:	dell	model:	emc xtremio	scope:	eq	version:	4.0	Trust: 1.0
vendor:	dell	model:	emc vnxe1600 operating environment	scope:	lt	version:	3.1.9.9570228	Trust: 1.0
vendor:	dell	model:	emc vnx2 operating environment	scope:	lt	version:	8.1.9.231	Trust: 1.0
vendor:	dell	model:	emc unisphere	scope:	lt	version:	8.4.0.8	Trust: 1.0
vendor:	dell	model:	emc vnxe 3300 operating environment	scope:	eq	version:	-	Trust: 1.0
vendor:	dell	model:	emc vnx2 operating environment	scope:	lt	version:	05.33.009.5.231	Trust: 1.0
vendor:	dell	model:	emc vmax embedded management	scope:	lte	version:	1.4.0.347	Trust: 1.0
vendor:	dell	model:	emc vnxe3200 operating environment	scope:	eq	version:	-	Trust: 1.0
vendor:	dell	model:	emc vasa provider virtual appliance	scope:	lt	version:	8.4.0.512	Trust: 1.0
vendor:	dell	model:	emc smis	scope:	lt	version:	8.4.0.6	Trust: 1.0
vendor:	dell	model:	emc vnx1 operating environment	scope:	eq	version:	05.32.000.5.225	Trust: 1.0
vendor:	dell	model:	emc vmax enas	scope:	eq	version:	8.0.1	Trust: 1.0
vendor:	dell	model:	emc unity operating environment	scope:	lt	version:	4.3.0.1522077968	Trust: 1.0
vendor:	dell	model:	emc vnxe 3150 operating environment	scope:	eq	version:	-	Trust: 1.0
vendor:	dell	model:	emc vnxe 3100 operating environment	scope:	eq	version:	-	Trust: 1.0
vendor:	dell	model:	emc vnx1 operating environment	scope:	eq	version:	7.1.82.0	Trust: 1.0
vendor:	dell	model:	emc solutions enabler virtual appliance	scope:	lt	version:	8.4.0.8	Trust: 1.0
vendor:	dell	model:	emc smis	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	emc solutions enabler virtual appliance	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	emc unisphere	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	emc unity operating environment	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	emc vasa provider virtual appliance	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	emc vipr srm	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	emc vmax embedded management	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	emc vmax enas	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	emc vnx1 operating environment	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	emc vnx2 operating environment	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	emc vnxe1600 operating environment	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	emc vnxe3100 operating environment	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	emc vnxe3150 operating environment	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	emc vnxe3200 operating environment	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	emc vnxe3300 operating environment	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	emc xtremio	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	emc vmax embedded management	scope:	eq	version:	1.4.0.347	Trust: 0.6
vendor:	emc	model:	vipr srm	scope:	eq	version:	3.6.1	Trust: 0.3
vendor:	emc	model:	unisphere for vmax	scope:	eq	version:	1.6	Trust: 0.3
vendor:	dell	model:	emc unisphere for vmax	scope:	eq	version:	8.2	Trust: 0.3
vendor:	dell	model:	emc solutions enabler	scope:	eq	version:	8.1.0.3	Trust: 0.3
vendor:	emc	model:	vipr srm	scope:	eq	version:	3.7	Trust: 0.3
vendor:	emc	model:	vnx2	scope:	ne	version:	05.33.009.5.231	Trust: 0.3
vendor:	emc	model:	vnx2	scope:	eq	version:	8.1.9.155	Trust: 0.3
vendor:	dell	model:	emc unisphere for vmax	scope:	eq	version:	8.3	Trust: 0.3
vendor:	emc	model:	vasa provider virtual appliance	scope:	eq	version:	8.3.0	Trust: 0.3
vendor:	emc	model:	unisphere for vmax	scope:	eq	version:	1.0	Trust: 0.3
vendor:	emc	model:	xtremio	scope:	eq	version:	4.0.4-41	Trust: 0.3
vendor:	emc	model:	vipr srm	scope:	eq	version:	4.0.1	Trust: 0.3
vendor:	emc	model:	vipr srm	scope:	eq	version:	3.6.4	Trust: 0.3
vendor:	emc	model:	vnx1	scope:	ne	version:	7.1.82.0	Trust: 0.3
vendor:	emc	model:	vnxe	scope:	eq	version:	0	Trust: 0.3
vendor:	dell	model:	emc solutions enabler	scope:	eq	version:	8.4.0.15	Trust: 0.3
vendor:	emc	model:	vmax enas	scope:	eq	version:	8	Trust: 0.3
vendor:	emc	model:	vnx2 oe for file	scope:	eq	version:	8.1.9.211	Trust: 0.3
vendor:	emc	model:	vipr srm	scope:	eq	version:	3.7.1	Trust: 0.3
vendor:	emc	model:	vipr srm	scope:	eq	version:	4.0	Trust: 0.3
vendor:	emc	model:	solutions enabler	scope:	eq	version:	8.0	Trust: 0.3
vendor:	emc	model:	smis	scope:	ne	version:	8.4.0.6	Trust: 0.3
vendor:	emc	model:	vnxe3200	scope:	eq	version:	3.1.5.8711957	Trust: 0.3
vendor:	dell	model:	emc vmax embedded management	scope:	ne	version:	1.4.0.347	Trust: 0.3
vendor:	emc	model:	vipr srm	scope:	eq	version:	4.0.3	Trust: 0.3
vendor:	emc	model:	solutions enabler	scope:	eq	version:	7.20	Trust: 0.3
vendor:	emc	model:	unity operating environment	scope:	eq	version:	0	Trust: 0.3
vendor:	emc	model:	unisphere for vmax	scope:	eq	version:	8.0.1	Trust: 0.3
vendor:	emc	model:	solutions enabler	scope:	ne	version:	8.4.0.8	Trust: 0.3
vendor:	dell	model:	emc unisphere for vmax	scope:	eq	version:	8.4.0.15	Trust: 0.3
vendor:	emc	model:	vipr srm	scope:	eq	version:	3.6.3	Trust: 0.3
vendor:	emc	model:	vnx2	scope:	ne	version:	8.1.9.231	Trust: 0.3
vendor:	dell	model:	emc solutions enabler	scope:	eq	version:	8.3	Trust: 0.3
vendor:	emc	model:	unisphere for vmax	scope:	eq	version:	1.1	Trust: 0.3
vendor:	emc	model:	vnx2 oe for file	scope:	eq	version:	8.1.9.217	Trust: 0.3
vendor:	emc	model:	vipr srm	scope:	eq	version:	3.6.0	Trust: 0.3
vendor:	emc	model:	unisphere for vmax	scope:	eq	version:	8.0.2.6	Trust: 0.3
vendor:	dell	model:	emc vmax embedded management	scope:	eq	version:	1.4	Trust: 0.3
vendor:	emc	model:	vasa provider virtual appliance	scope:	eq	version:	8.4.0	Trust: 0.3
vendor:	emc	model:	vipr srm	scope:	eq	version:	3.6.2	Trust: 0.3
vendor:	emc	model:	vnx2 oe for file	scope:	eq	version:	8.1.9.155	Trust: 0.3
vendor:	emc	model:	unisphere for vmax	scope:	eq	version:	8.0	Trust: 0.3
vendor:	emc	model:	vnxe1600	scope:	ne	version:	3.1.9.9570228	Trust: 0.3
vendor:	emc	model:	vnxe3200	scope:	eq	version:	3.1.0	Trust: 0.3
vendor:	emc	model:	vnx1	scope:	eq	version:	7.1.80.3	Trust: 0.3
vendor:	emc	model:	unisphere for vmax	scope:	eq	version:	1.6.1.6	Trust: 0.3
vendor:	emc	model:	vnx2	scope:	eq	version:	8.0	Trust: 0.3
vendor:	emc	model:	unity operating environment	scope:	ne	version:	4.3.0.1522077968	Trust: 0.3
vendor:	emc	model:	unisphere for vmax	scope:	ne	version:	8.4.0.8	Trust: 0.3
vendor:	emc	model:	unisphere for vmax	scope:	eq	version:	8.0.3.4	Trust: 0.3
vendor:	emc	model:	unisphere for vmax	scope:	eq	version:	1.5	Trust: 0.3
vendor:	emc	model:	vnxe1600	scope:	eq	version:	0	Trust: 0.3
vendor:	emc	model:	vipr srm	scope:	eq	version:	3.7.2	Trust: 0.3
vendor:	dell	model:	emc solutions enabler	scope:	eq	version:	8.2	Trust: 0.3
vendor:	emc	model:	vnx1	scope:	eq	version:	7.0	Trust: 0.3
vendor:	emc	model:	vasa provider virtual appliance	scope:	ne	version:	8.4.0.512	Trust: 0.3
vendor:	emc	model:	solutions enabler	scope:	eq	version:	6.5.883	Trust: 0.3
vendor:	emc	model:	unisphere for vmax	scope:	eq	version:	8.0.2	Trust: 0.3
vendor:	emc	model:	vipr srm	scope:	eq	version:	4.0.2	Trust: 0.3

sources: BID: 104024 // JVNDB: JVNDB-2018-004978 // CNNVD: CNNVD-201805-031 // NVD: CVE-2018-1183

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-1183
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2018-1183
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-201805-031
value:	HIGH
Trust: 0.6
VULHUB:	VHN-121728
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2018-1183
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-121728
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-1183
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-121728 // JVNDB: JVNDB-2018-004978 // CNNVD: CNNVD-201805-031 // NVD: CVE-2018-1183

PROBLEMTYPE DATA

problemtype:

CWE-611

Trust: 1.9

sources: VULHUB: VHN-121728 // JVNDB: JVNDB-2018-004978 // NVD: CVE-2018-1183

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201805-031

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201805-031

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-004978

PATCH

title:	Top Page	url:	https://www.dellemc.com/en-us/index.htm	Trust: 0.8
title:	Multiple Dell EMC Product security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79775	Trust: 0.6

sources: JVNDB: JVNDB-2018-004978 // CNNVD: CNNVD-201805-031

EXTERNAL IDS

db:	NVD	id:	CVE-2018-1183	Trust: 2.8
db:	BID	id:	104024	Trust: 1.4
db:	JVNDB	id:	JVNDB-2018-004978	Trust: 0.8
db:	CNNVD	id:	CNNVD-201805-031	Trust: 0.6
db:	VULHUB	id:	VHN-121728	Trust: 0.1

sources: VULHUB: VHN-121728 // BID: 104024 // JVNDB: JVNDB-2018-004978 // CNNVD: CNNVD-201805-031 // NVD: CVE-2018-1183

REFERENCES

url:	http://seclists.org/fulldisclosure/2018/apr/61	Trust: 2.8
url:	http://www.securityfocus.com/bid/104024	Trust: 1.1
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-1183	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-1183	Trust: 0.8
url:	http://dell.com	Trust: 0.3

sources: VULHUB: VHN-121728 // BID: 104024 // JVNDB: JVNDB-2018-004978 // CNNVD: CNNVD-201805-031 // NVD: CVE-2018-1183

CREDITS

Jakub Palaczynski

Trust: 0.3

sources: BID: 104024

SOURCES

db:	VULHUB	id:	VHN-121728
db:	BID	id:	104024
db:	JVNDB	id:	JVNDB-2018-004978
db:	CNNVD	id:	CNNVD-201805-031
db:	NVD	id:	CVE-2018-1183

LAST UPDATE DATE

2024-11-23T22:26:25.136000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-121728	date:	2018-06-13T00:00:00
db:	BID	id:	104024	date:	2018-04-25T00:00:00
db:	JVNDB	id:	JVNDB-2018-004978	date:	2018-07-03T00:00:00
db:	CNNVD	id:	CNNVD-201805-031	date:	2018-05-07T00:00:00
db:	NVD	id:	CVE-2018-1183	date:	2024-11-21T03:59:21.123

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-121728	date:	2018-04-30T00:00:00
db:	BID	id:	104024	date:	2018-04-25T00:00:00
db:	JVNDB	id:	JVNDB-2018-004978	date:	2018-07-03T00:00:00
db:	CNNVD	id:	CNNVD-201805-031	date:	2018-04-30T00:00:00
db:	NVD	id:	CVE-2018-1183	date:	2018-04-30T20:29:00.310