7.5high
CVE-2017-10949
Directory Traversal in Dell Storage Manager 2016 R2.1 causes Information Disclosure when the doGet method of the EmWebsiteServlet class doe…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
5.4%
percentile 93%
Public exploits
0
none known
Summary
Directory Traversal in Dell Storage Manager 2016 R2.1 causes Information Disclosure when the doGet method of the EmWebsiteServlet class doesn't properly validate user provided path before using it in file operations. Was ZDI-CAN-4459.
Exploit prediction (EPSS)
5.40% probability of exploitation in the next 30 days, higher than 93% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- Zero Day Initiative Dell Storage Manager
Classification
- Weakness
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
- topics-cdn.dell.com /pdf/dell-compellent-sc8000_release%20notes24_en-us.pdf · x_refsource_MISC, x_transferred
- zerodayinitiative.com /advisories/ZDI-17-523 · x_refsource_MISC, x_transferred
- securityfocus.com /bid/100138 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2017-10949
- NVD: CVE-2017-10949
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.