CVE-2015-4525

The log-gather implementation in the web administration interface in EMC Isilon OneFS 6.5.x.x through 7.1.1.x before 7.1.1.5 and 7.2.0.x before 7.2.0.2 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.

CVSS v2.0 9.0 HIGH

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://seclists.org/bugtraq/2015/Jul/11

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:emc:isilon_onefs::::::::
	cpe:2.3:o:emc:isilon_onefs:7.1.1.1:::::::*
	cpe:2.3:o:emc:isilon_onefs:7.1.1.2:::::::*
	cpe:2.3:o:emc:isilon_onefs:7.1.1.3:::::::*
	cpe:2.3:o:emc:isilon_onefs:7.1.1.4:::::::*
	cpe:2.3:o:emc:isilon_onefs:7.2.0.0:::::::*
	cpe:2.3:o:emc:isilon_onefs:7.2.0.1:::::::*

History

No history.

Information

Published : 2015-07-04 10:59

Updated : 2024-02-04 18:53

NVD link : CVE-2015-4525

Mitre link : CVE-2015-4525

CVE.ORG link : CVE-2015-4525

JSON object : View

Products Affected

emc

isilon_onefs

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2015-4525", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-07-04T10:59:03.153", "references": [{"url": "http://seclists.org/bugtraq/2015/Jul/11", "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "The log-gather implementation in the web administration interface in EMC Isilon OneFS 6.5.x.x through 7.1.1.x before 7.1.1.5 and 7.2.0.x before 7.2.0.2 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors."}, {"lang": "es", "value": "La implementaci\u00f3n log-gather en la interfaz de la administraci\u00f3n web en EMC Isilon OneFS 6.5.x.x hasta 7.1.1.x anterior a 7.1.1.5 y 7.2.0.x anterior a 7.2.0.2 permite a usuarios remotos autenticados ejecutar comandos arbitrarios con privilegios root a trav\u00e9s de vectores no especificados."}], "lastModified": "2015-07-08T18:55:45.403", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:emc:isilon_onefs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DBE16CA-46F6-4E5C-B361-67074B1771F1", "versionEndIncluding": "7.1.1.0"}, {"criteria": "cpe:2.3:o:emc:isilon_onefs:7.1.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A669BE6B-726F-4F34-A009-798E32FF6895"}, {"criteria": "cpe:2.3:o:emc:isilon_onefs:7.1.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE74624-A44D-4837-AD36-DBF3E93D5ED9"}, {"criteria": "cpe:2.3:o:emc:isilon_onefs:7.1.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47CBA2E5-6E46-4922-B56B-3F8C578074B1"}, {"criteria": "cpe:2.3:o:emc:isilon_onefs:7.1.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "90C22C93-9069-406E-9A14-03F20AD34D11"}, {"criteria": "cpe:2.3:o:emc:isilon_onefs:7.2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E8AF3E1-FE57-40B9-95DD-4E4C8EB578CB"}, {"criteria": "cpe:2.3:o:emc:isilon_onefs:7.2.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F551F88-3176-4E92-AE7A-FCAB3A220A45"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}