CVE-2017-8012 - In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs, the Java Manageme

CVE-2017-8012

Summary

In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs, the Java Management Extensions (JMX) protocol used to communicate between components in the Alerting and/or Compliance components can be leveraged to create a denial of service (DoS) condition. Attackers with knowledge of JMX agent user credentials could potentially exploit this vulnerability to create arbitrary files on the affected system and create a DoS condition by leveraging inherent JMX protocol capabilities.

References

Vulnerable Configurations

cpe:2.3:a:dell:emc_m\&r:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:emc_m\&r:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:emc_storage_monitoring_and_reporting:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:emc_storage_monitoring_and_reporting:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:emc_vipr_srm:-:*:*:*:*:*:*:*
cpe:2.3:a:dell:emc_vipr_srm:-:*:*:*:*:*:*:*
cpe:2.3:a:dell:emc_vipr_srm:3.7:*:*:*:*:windows:*:*
cpe:2.3:a:dell:emc_vipr_srm:3.7:*:*:*:*:windows:*:*
cpe:2.3:a:dell:emc_vipr_srm:3.7.1:*:*:*:*:windows:*:*
cpe:2.3:a:dell:emc_vipr_srm:3.7.1:*:*:*:*:windows:*:*
cpe:2.3:a:dell:emc_vipr_srm:3.7.2:*:*:*:*:windows:*:*
cpe:2.3:a:dell:emc_vipr_srm:3.7.2:*:*:*:*:windows:*:*
cpe:2.3:a:dell:emc_vipr_srm:4.0:*:*:*:*:windows:*:*
cpe:2.3:a:dell:emc_vipr_srm:4.0:*:*:*:*:windows:*:*
cpe:2.3:a:dell:emc_vipr_srm:4.0.1:*:*:*:*:windows:*:*
cpe:2.3:a:dell:emc_vipr_srm:4.0.1:*:*:*:*:windows:*:*
cpe:2.3:a:dell:emc_vipr_srm:4.0.2:*:*:*:*:*:*:*
cpe:2.3:a:dell:emc_vipr_srm:4.0.2:*:*:*:*:*:*:*
cpe:2.3:a:dell:emc_vipr_srm:4.0.2:*:*:*:*:windows:*:*
cpe:2.3:a:dell:emc_vipr_srm:4.0.2:*:*:*:*:windows:*:*
cpe:2.3:a:dell:emc_vnx_monitoring_and_reporting:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:emc_vnx_monitoring_and_reporting:*:*:*:*:*:*:*:*

CVSS

Base:	5.8 (as of 13-09-2021 - 12:07)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:P/A:P

refmap via4

bid	100982
confirm	http://seclists.org/fulldisclosure/2017/Sep/51
sectrack	1039417 1039418

Last major update

13-09-2021 - 12:07

Published

22-09-2017 - 01:29

Last modified

13-09-2021 - 12:07