CVE-2018-6978 Privilege escalation in n/a
A local admin user with shell access can exploit improper script permissions to escalate privileges to root on the vRealize Operations machine.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-6978?
CVE-2018-6978 is a medium-severity vulnerability in n/a, published on 18 Dec 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
vRealize Operations (7.x before 7.0.0.11287810, 6.7.x before 6.7.0.11286837 and 6.6.x before 6.6.1.11286876) contains a local privilege escalation vulnerability due to improper permissions of support scripts. Admin user of the vROps application with shell access may exploit this issue to elevate the privileges to root on a vROps machine. Note: the admin user (non-sudoer) should not be confused with root of the vROps machine.
Weakness: CWE-732
Which versions are affected by CVE-2018-6978?
It affects 1 product.
Products include Vmware Vrealize Operations.
How do I fix CVE-2018-6978?
No fix has been published for CVE-2018-6978 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-6978 being exploited?
There is no known exploitation of CVE-2018-6978 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2016-7457 Privilege escalation in n/a
- CVE-2020-3943 Code injection in vRealize Operations for Horizon Adapter
- CVE-2023-20856 Cross-site request forgery in VMware vRealize Operations (vROps)
- CVE-2022-31673 Information disclosure in VMware vRealize Operations
- CVE-2020-3944 Auth bypass in vRealize Operations for Horizon Adapter
Sources
Also known as GHSA-6www-r2fm-fcq7.