CVE-2017-8196 Missing authorization in FusionSphere
An authenticated attacker can bypass authorization to query, modify, or delete service data and cause service unavailability in Huawei FusionSphere.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-8196?
CVE-2017-8196 is a medium-severity missing authorization vulnerability in Huawei Technologies Co., Ltd. FusionSphere, published on 22 Nov 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
FusionSphere V100R006C00SPC102(NFV) has an incorrect authorization vulnerability. An authenticated attacker could execute commands that he/she should have had no permission to perform, thereby querying, modifying, and deleting certain service data and making the service unavailable.
Weakness: CWE-863
Which versions are affected by CVE-2017-8196?
It affects 1 product.
Products include Huawei Fusionsphere.
How do I fix CVE-2017-8196?
No fix has been published for CVE-2017-8196 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2017-8196 being exploited?
There is no known exploitation of CVE-2017-8196 in the wild and no public exploit code.
Other vulnerabilities in Huawei Technologies Co., Ltd. FusionSphere
Sources
Also known as GHSA-h828-x469-v3gx.