CVE-2017-10949

{"id": "CVE-2017-10949", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2017-08-04T15:29:00.230", "references": [{"url": "http://topics-cdn.dell.com/pdf/dell-compellent-sc8000_release%20notes24_en-us.pdf", "tags": ["Release Notes", "Vendor Advisory"], "source": "zdi-disclosures@trendmicro.com"}, {"url": "http://www.securityfocus.com/bid/100138", "tags": ["Third Party Advisory", "VDB Entry"], "source": "zdi-disclosures@trendmicro.com"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-17-523", "tags": ["Third Party Advisory", "VDB Entry"], "source": "zdi-disclosures@trendmicro.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory Traversal in Dell Storage Manager 2016 R2.1 causes Information Disclosure when the doGet method of the EmWebsiteServlet class doesn't properly validate user provided path before using it in file operations. Was ZDI-CAN-4459."}, {"lang": "es", "value": "Una vulnerabilidad de salto de directorio en Dell Storage Manager 2016 R2.1 da lugar a una divulgaci\u00f3n de informaci\u00f3n cuando el m\u00e9todo doGet de la clase EmWebsiteServlet no valida correctamente la ruta ofrecida por el usuario y la utiliza en operaciones de archivos."}], "lastModified": "2017-08-15T18:42:08.847", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:storage_manager_2016:r2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3875384E-E153-4430-A792-9351651C65CB"}], "operator": "OR"}]}], "sourceIdentifier": "zdi-disclosures@trendmicro.com"}