Dell EMC ECOM XML Parser Vulnerability Exposing Sensitive Data
CVE-2018-1183

9.8CRITICAL

Key Information:

Vendor
Dell
Status
Dell Emc Unisphere For Vmax Virtual Appliance, Dell Emc Solutions Enabler Virtual Appliance, Dell Emc Vasa Provider Virtual Appliance, Dell Emc Smis, Dell Emc Vmax Embedded Management (emanagement), Dell Emc Vnx2 Operating Environment (oe) For File, Dell Emc Vnx2 Operating Environment (oe) For Block, Dell Emc Vnx1 Operating Environment (oe) For File, Dell Emc Vnx1 Operating Environment (oe) For Block, Dell Emc Vnxe3200 Operating Environment (oe), Dell Emc Vnxe1600 Operating Environment (oe), Dell Emc Vnxe 3100/3150/3300 Operating Environment (oe), Dell Emc Vipr Srm, Dell Emc Vipr Srm, Dell Emc Xtremio, Dell Emc Vmax Enas, Dell Emc Unity Operating Environment (oe)
Vendor
CVE Published:
30 April 2018

Summary

The Dell EMC ECOM product configuration contains a vulnerability that allows for XML External Entity (XXE) injection. Attackers can exploit this vulnerability by supplying malicious XML input that includes a reference to an external entity. This may grant them unauthorized access to sensitive files within the system or potentially lead to denial-of-service scenarios. This flaw affects multiple Dell EMC products, making it crucial for users to apply the appropriate security updates to mitigate possible risks.

Affected Version(s)

Dell EMC Unisphere for VMAX Virtual Appliance, Dell EMC Solutions Enabler Virtual Appliance, Dell EMC VASA Provider Virtual Appliance, Dell EMC SMIS, Dell EMC VMAX Embedded Management (eManagement), Dell EMC VNX2 Operating Environment (OE) for File, Dell EMC VNX2 Operating Environment (OE) for Block, Dell EMC VNX1 Operating Environment (OE) for File, Dell EMC VNX1 Operating Environment (OE) for Block, Dell EMC VNXe3200 Operating Environment (OE), Dell EMC VNXe1600 Operating Environment (OE), Dell EMC VNXe 3100/3150/3300 Operating Environment (OE), Dell EMC ViPR SRM, Dell EMC ViPR SRM, Dell EMC XtremIO, Dell EMC VMAX eNAS, Dell EMC Unity Operating Environment (OE) Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to 8.4.0.6, Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347, Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231, Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231, Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0, Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225, Dell EMC VNXe3200 Operating Environment (OE) all versions, Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228, Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) all versions, Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 (only if using Dell EMC Host Interface for Windows), Dell EMC ViPR SRM versions ...[truncated*]

References

http://seclists.org/fulldisclosure/2018/Apr/61
mailing-listx_refsource_FULLDISC
http://www.securityfocus.com/bid/104024
vdb-entryx_refsource_BID

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.