CVE-2018-11077

MEDIUM

Dell EMC Avamar Server 7.2.0-7.5.1 and 18.1 - Authenticated OS Command Injection via getlogs Utility

Title source: llm
STIX 2.1

Description

'getlogs' utility in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1 and 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 is affected by an OS command injection vulnerability. A malicious Avamar admin user may potentially be able to execute arbitrary commands under root privilege.

References (4)

Core 4
Core References
Patch, Third Party Advisory x_refsource_confirm
https://www.vmware.com/security/advisories/VMSA-2018-0029.html
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
https://seclists.org/fulldisclosure/2018/Nov/51
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/105971
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1042153

Scores

CVSS v3 6.7
EPSS 0.0037
EPSS Percentile 58.8%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (31)
dell/emc_avamar 7.2.0
dell/emc_avamar 7.2.1
dell/emc_avamar 7.3.0
dell/emc_avamar 7.3.1
dell/emc_avamar 7.4.0
dell/emc_avamar 7.4.1
dell/emc_avamar 7.5.0
dell/emc_avamar 7.5.1
dell/emc_avamar 18.1
dell/emc_integrated_data_protection_appliance 2.0
... and 21 more
Published Nov 26, 2018
Tracked Since Feb 18, 2026