CVE-2018-11063
CVSS V2 Medium 4.6
CVSS V3 High 7.8
Description
Dell WMS versions 1.1 and prior are impacted by multiple unquoted service path vulnerabilities. Affected software installs multiple services incorrectly by specifying the paths to the service executables without quotes. This could potentially allow a low-privileged local user to execute arbitrary executables with elevated privileges.
Overview
- CVE ID
- CVE-2018-11063
- Assigner
- security_alert@emc.com
- Vulnerability Status
- Analyzed
- Published Version
- 2018-08-10T20:29:00
- Last Modified Date
- 2018-10-16T17:09:36
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:dell:wyse_management_suite:*:*:*:*:pro:*:*:* | 1 | OR | 1.1 | |
| cpe:2.3:a:dell:wyse_management_suite:*:*:*:*:standard:*:*:* | 1 | OR | 1.1 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:L/AC:L/Au:N/C:P/I:P/A:P
- Access Vector
- LOCAL
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 4.6
- Severity
- MEDIUM
- Exploitability Score
- 3.9
- Impact Score
- 6.4
CVSS Version 3
- Version
- 3.0
- Vector String
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- LOCAL
- Attack Compatibility
- LOW
- Privileges Required
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 7.8
- Base Severity
- HIGH
- Exploitability Score
- 1.8
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| https://www.dell.com/support/article/us/en/19/sln313398/dell-wyse-management-suite-multiple-unquoted-service-path-vulnerabilities?lang=en | Vendor Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2018-11063 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11063 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 18:14:33 | Added to TrackCVE | |||
| 2022-12-03 11:04:13 | secure@dell.com | security_alert@emc.com | CVE Assigner | updated |
| 2022-12-03 11:04:13 | 2018-08-10T20:29Z | 2018-08-10T20:29:00 | CVE Published Date | updated |
| 2022-12-03 11:04:13 | 2018-10-16T17:09:36 | CVE Modified Date | updated | |
| 2022-12-03 11:04:13 | Analyzed | Vulnerability Status | updated |