cnvd - cnvd-2018-23619

cnvd-2018-23619

Vulnerability from cnvd

Title: Dell EMC Avamar开放重定向漏洞

Description:

Dell EMC Avamar是一套用于服务器的完全虚拟化的备份和恢复软件。

Dell EMC Avamar存在开放重定向漏洞。远程未经身份验证的攻击者可能会利用此漏洞通过欺骗受害用户单击恶意构建的链接，将应用程序用户重定向到任意Web URL。

Severity: 中

Patch Name: Dell EMC Avamar开放重定向漏洞的补丁

Patch Description:

Dell EMC Avamar是一套用于服务器的完全虚拟化的备份和恢复软件。

Dell EMC Avamar存在开放重定向漏洞。远程未经身份验证的攻击者可能会利用此漏洞通过欺骗受害用户单击恶意构建的链接，将应用程序用户重定向到任意Web URL。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

用户可参考如下供应商提供的安全公告获得补丁信息： https://seclists.org/fulldisclosure/2018/Nov/49

Reference: https://seclists.org/fulldisclosure/2018/Nov/49

Impacted products

Name
['Dell EMC Avamar Server 7.3.1', 'Dell EMC Avamar Server 7.4.1', 'Dell EMC Avamar Server 7.5.0', 'Dell EMC Avamar Server 7.2.0', 'Dell EMC Avamar Server 7.2.1', 'Dell EMC Avamar Server 7.3.0', 'Dell EMC Avamar Server 7.4.0', 'Dell EMC Avamar Server 7.5.1', 'Dell EMC Avamar Server 18.1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-11067"
    }
  },
  "description": "Dell EMC Avamar\u662f\u4e00\u5957\u7528\u4e8e\u670d\u52a1\u5668\u7684\u5b8c\u5168\u865a\u62df\u5316\u7684\u5907\u4efd\u548c\u6062\u590d\u8f6f\u4ef6\u3002\n\nDell EMC Avamar\u5b58\u5728\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u653b\u51fb\u8005\u53ef\u80fd\u4f1a\u5229\u7528\u6b64\u6f0f\u6d1e\u901a\u8fc7\u6b3a\u9a97\u53d7\u5bb3\u7528\u6237\u5355\u51fb\u6076\u610f\u6784\u5efa\u7684\u94fe\u63a5\uff0c\u5c06\u5e94\u7528\u7a0b\u5e8f\u7528\u6237\u91cd\u5b9a\u5411\u5230\u4efb\u610fWeb URL\u3002",
  "discovererName": "Jarrod Farncomb",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://seclists.org/fulldisclosure/2018/Nov/49",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-23619",
  "openTime": "2018-11-21",
  "patchDescription": "Dell EMC Avamar\u662f\u4e00\u5957\u7528\u4e8e\u670d\u52a1\u5668\u7684\u5b8c\u5168\u865a\u62df\u5316\u7684\u5907\u4efd\u548c\u6062\u590d\u8f6f\u4ef6\u3002\r\n\r\nDell EMC Avamar\u5b58\u5728\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u653b\u51fb\u8005\u53ef\u80fd\u4f1a\u5229\u7528\u6b64\u6f0f\u6d1e\u901a\u8fc7\u6b3a\u9a97\u53d7\u5bb3\u7528\u6237\u5355\u51fb\u6076\u610f\u6784\u5efa\u7684\u94fe\u63a5\uff0c\u5c06\u5e94\u7528\u7a0b\u5e8f\u7528\u6237\u91cd\u5b9a\u5411\u5230\u4efb\u610fWeb URL\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Dell EMC Avamar\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Dell EMC Avamar Server 7.3.1",
      "Dell EMC Avamar Server 7.4.1",
      "Dell EMC Avamar Server 7.5.0",
      "Dell EMC Avamar Server 7.2.0",
      "Dell EMC Avamar Server 7.2.1",
      "Dell EMC Avamar Server 7.3.0",
      "Dell EMC Avamar Server 7.4.0",
      "Dell EMC Avamar Server 7.5.1",
      "Dell EMC Avamar Server 18.1"
    ]
  },
  "referenceLink": "https://seclists.org/fulldisclosure/2018/Nov/49",
  "serverity": "\u4e2d",
  "submitTime": "2018-11-21",
  "title": "Dell EMC Avamar\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e"
}

CVE-2018-11067 (GCVE-0-2018-11067)

Vulnerability from cvelistv5

Published

2018-11-26 20:00

Modified

2024-09-17 00:11

Severity ?

CWE

Open Redirection Vulnerability

Summary

Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 contain an open redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites.

References

▼	URL	Tags
	https://seclists.org/fulldisclosure/2018/Nov/49	mailing-list, x_refsource_FULLDISC
	https://www.vmware.com/security/advisories/VMSA-2018-0029.html	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/105969	vdb-entry, x_refsource_BID
	http://www.securitytracker.com/id/1042153	vdb-entry, x_refsource_SECTRACK

Impacted products

Vendor

Product

Version

▼

Dell EMC

Avamar

Version: 7.2.0
Version: 7.2.1
Version: 7.3.0
Version: 7.3.1
Version: 7.4.0
Version: 7.4.1
Version: 7.5.0
Version: 7.5.1
Version: 18.1

Dell EMC

Integrated Data Protection Appliance

Version: 2.0
Version: 2.1
Version: 2.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:54:36.648Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20181120 DSA-2018-145: Dell EMC Avamar Multiple Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "https://seclists.org/fulldisclosure/2018/Nov/49"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.vmware.com/security/advisories/VMSA-2018-0029.html"
          },
          {
            "name": "105969",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105969"
          },
          {
            "name": "1042153",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1042153"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Avamar",
          "vendor": "Dell EMC",
          "versions": [
            {
              "status": "affected",
              "version": "7.2.0"
            },
            {
              "status": "affected",
              "version": "7.2.1"
            },
            {
              "status": "affected",
              "version": "7.3.0"
            },
            {
              "status": "affected",
              "version": "7.3.1"
            },
            {
              "status": "affected",
              "version": "7.4.0"
            },
            {
              "status": "affected",
              "version": "7.4.1"
            },
            {
              "status": "affected",
              "version": "7.5.0"
            },
            {
              "status": "affected",
              "version": "7.5.1"
            },
            {
              "status": "affected",
              "version": "18.1"
            }
          ]
        },
        {
          "product": "Integrated Data Protection Appliance",
          "vendor": "Dell EMC",
          "versions": [
            {
              "status": "affected",
              "version": "2.0"
            },
            {
              "status": "affected",
              "version": "2.1"
            },
            {
              "status": "affected",
              "version": "2.2"
            }
          ]
        }
      ],
      "datePublic": "2018-11-20T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 contain an open redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Open Redirection Vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-11-27T16:57:01",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "name": "20181120 DSA-2018-145: Dell EMC Avamar Multiple Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "https://seclists.org/fulldisclosure/2018/Nov/49"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.vmware.com/security/advisories/VMSA-2018-0029.html"
        },
        {
          "name": "105969",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105969"
        },
        {
          "name": "1042153",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1042153"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Dell EMC Avamar and Integrated Data Protection Appliance Open Redirection Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security_alert@emc.com",
          "DATE_PUBLIC": "2018-11-20T05:00:00.000Z",
          "ID": "CVE-2018-11067",
          "STATE": "PUBLIC",
          "TITLE": "Dell EMC Avamar and Integrated Data Protection Appliance Open Redirection Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Avamar",
                      "version": {
                        "version_data": [
                          {
                            "affected": "=",
                            "version_affected": "=",
                            "version_value": "7.2.0"
                          },
                          {
                            "affected": "=",
                            "version_affected": "=",
                            "version_value": "7.2.1"
                          },
                          {
                            "affected": "=",
                            "version_affected": "=",
                            "version_value": "7.3.0"
                          },
                          {
                            "affected": "=",
                            "version_affected": "=",
                            "version_value": "7.3.1"
                          },
                          {
                            "affected": "=",
                            "version_affected": "=",
                            "version_value": "7.4.0"
                          },
                          {
                            "affected": "=",
                            "version_affected": "=",
                            "version_value": "7.4.1"
                          },
                          {
                            "version_value": "7.5.0"
                          },
                          {
                            "version_value": "7.5.1"
                          },
                          {
                            "version_value": "18.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Integrated Data Protection Appliance",
                      "version": {
                        "version_data": [
                          {
                            "affected": "=",
                            "version_affected": "=",
                            "version_value": "2.0"
                          },
                          {
                            "affected": "=",
                            "version_affected": "=",
                            "version_value": "2.1"
                          },
                          {
                            "affected": "=",
                            "version_affected": "=",
                            "version_value": "2.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Dell EMC"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 contain an open redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Open Redirection Vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20181120 DSA-2018-145: Dell EMC Avamar Multiple Vulnerabilities",
              "refsource": "FULLDISC",
              "url": "https://seclists.org/fulldisclosure/2018/Nov/49"
            },
            {
              "name": "https://www.vmware.com/security/advisories/VMSA-2018-0029.html",
              "refsource": "CONFIRM",
              "url": "https://www.vmware.com/security/advisories/VMSA-2018-0029.html"
            },
            {
              "name": "105969",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105969"
            },
            {
              "name": "1042153",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1042153"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2018-11067",
    "datePublished": "2018-11-26T20:00:00Z",
    "dateReserved": "2018-05-14T00:00:00",
    "dateUpdated": "2024-09-17T00:11:44.344Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted