CVE-2018-1217 Missing authorization in Avamar, Integrated Data Protection Appliance
Remote unauthenticated attackers can read or modify Local Download Service credentials in Dell EMC Avamar Installation Manager, potentially impersonating service actions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-1217?
CVE-2018-1217 is a critical missing authorization vulnerability in Dell EMC Avamar, Integrated Data Protection Appliance, published on 9 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a missing access control check vulnerability which could potentially allow a remote unauthenticated attacker to read or change the Local Download Service (LDLS) credentials. The LDLS credentials are used to connect to Dell EMC Online Support. If the LDLS configuration was changed to an invalid configuration, then Avamar Installation Manager may not be able to connect to Dell EMC Online Support web site successfully. The remote unauthenticated attacker can also read and use the credentials to login to Dell EMC Online Support, impersonating the AVI service actions using those credentials.
Weakness: CWE-862
Which versions are affected by CVE-2018-1217?
It affects 2 products.
Products include Dell Emc Avamar, Dell Emc Integrated Data Protection Appliance.
How do I fix CVE-2018-1217?
No fix has been published for CVE-2018-1217 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-1217 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-1217 exists.
Public exploit code: 1 Exploit-DB entry and 1 Nuclei template.
Other vulnerabilities in Dell EMC Avamar, Integrated Data Protection Appliance
- CVE-2018-11066 Dell EMC Avamar and Integrated Data Protection Appliance Remote Code Execution Vulnerability
- CVE-2018-11077 Dell EMC Avamar and Integrated Data Protection Appliance Command Injection Vulnerability
- CVE-2018-11076 Dell EMC Avamar and Integrated Data Protection Appliance Information Exposure Vulnerability
- CVE-2018-11067 Dell EMC Avamar and Integrated Data Protection Appliance Open Redirection Vulnerability
Sources
Also known as GHSA-6583-rv3q-95pf.