8.8high
CVE-2017-8007
In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs, the Webservice Gateway is affected by a directory traver…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
3.0%
percentile 87%
Public exploits
0
none known
Summary
In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs, the Webservice Gateway is affected by a directory traversal vulnerability. Attackers with knowledge of Webservice Gateway credentials could potentially exploit this vulnerability to access unauthorized information, and modify or delete data, by supplying specially crafted strings in input parameters of the web service call.
Exploit prediction (EPSS)
2.96% probability of exploitation in the next 30 days, higher than 87% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- n/a EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R (Watch4Net) for SAS Solution Packs
Classification
- Weakness
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
- securityfocus.com /bid/100957 · vdb-entry, x_refsource_BID, x_transferred
- securitytracker.com /id/1039418 · vdb-entry, x_refsource_SECTRACK, x_transferred
- seclists.org /fulldisclosure/2017/Sep/51 · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1039417 · vdb-entry, x_refsource_SECTRACK, x_transferred
Sources
- CVE List: CVE-2017-8007
- NVD: CVE-2017-8007
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.