Vulnerabilities > CVE-2018-11076

047910
CVSS 6.5 - MEDIUM
Attack vector
ADJACENT_NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
low complexity
dell
vmware
nessus
NVD
Published: 2018-11-26
Updated: 2024-11-21

Summary

Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0 and 7.4.1 and Dell EMC Integrated Data Protection Appliance (IDPA) 2.0 are affected by an information exposure vulnerability. Avamar Java management console's SSL/TLS private key may be leaked in the Avamar Java management client package. The private key could potentially be used by an unauthenticated attacker on the same data-link layer to initiate a MITM attack on management console users.

Vulnerable Configurations

Part Description Count
Application
Dell
7
Application
Vmware
19

Nessus

NASL familyMisc.
NASL idVMWARE_VSPHERE_DATA_PROTECTION_VMSA-2018-0029.NASL
descriptionThe version of VMware vSphere Data Protection installed on the remote host is 6.0.x < 6.0.9 and 6.1.x < 6.1.10. It is, therefore, affected by the following vulnerabilities: - A remote command execution vulnerability. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. (CVE-2018-11066) - An open redirection vulnerability. An unauthenticated, remote attacker can exploit this to redirect application users to arbitrary, potentially malicious, web URLs. (CVE-2018-11067) - A command injection vulnerability exists in the
last seen2020-06-01
modified2020-06-02
plugin id119304
published2018-11-30
reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/119304
titleVMware vSphere Data Protection 6.0.x < 6.0.9 / 6.1.x < 6.1.10 Multiple Vulnerabilities (VMSA-2018-0029)

References