CVE-2018-1185: Command Injection

Q: What is the severity of CVE-2018-1185?

CVE-2018-1185 has been assigned a medium severity level due to the potential for command injection by an authenticated user.

Q: How do I fix CVE-2018-1185?

To resolve CVE-2018-1185, upgrade to EMC RecoverPoint for Virtual Machines version 5.1.1 or later, or EMC RecoverPoint version 5.1.0.0 or later.

Q: Who is affected by CVE-2018-1185?

CVE-2018-1185 affects EMC RecoverPoint for Virtual Machines versions prior to 5.1.1 and RecoverPoint versions 5.1.0.0 and earlier.

Q: What type of vulnerability is CVE-2018-1185?

CVE-2018-1185 is a command injection vulnerability that could allow an admin user to escape from a restricted shell.

Q: What are the potential impacts of CVE-2018-1185?

If exploited, CVE-2018-1185 could allow a malicious admin user to execute arbitrary commands on the system.

Published Feb 3, 2018

Updated

An issue was discovered in EMC RecoverPoint for Virtual Machines versions prior to 5.1.1, EMC RecoverPoint version 5.1.0.0, and EMC RecoverPoint versions prior to 5.0.1.3. Command injection vulnerability in Admin CLI may allow a malicious user with admin privileges to escape from the restricted shell to an interactive shell and run arbitrary commands with root privileges.

Affected Software

3 affected components

Dell EMC RecoverPoint<5.0.1.3

Dell EMC RecoverPoint=5.1.0.0

Dell Emc Recoverpoint For Virtual Machines<5.1.1

Remediation

Patch Available

http://seclists.org/fulldisclosure/2018/Feb/9

Event History

Feb 3, 2018

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-1185?

CVE-2018-1185 has been assigned a medium severity level due to the potential for command injection by an authenticated user.

How do I fix CVE-2018-1185?