CVE-2018-11076
Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0 and 7.4.1 and Dell EMC Integrated Data Protection Appliance (IDPA) 2.0 are affected by an information exposure vulnerability.
Does this matter?
Lower severity and a low EPSS score (0.83%). Track it; it rarely justifies an emergency change on its own.
Description
Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0 and 7.4.1 and Dell EMC Integrated Data Protection Appliance (IDPA) 2.0 are affected by an information exposure vulnerability. Avamar Java management console's SSL/TLS private key may be leaked in the Avamar Java management client package. The private key could potentially be used by an unauthenticated attacker on the same data-link layer to initiate a MITM attack on management console users.
- CVSS 3.0
- 6.5 MEDIUMCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.83% probability · 56th percentile
- CISA KEV
- Not listed
- Affected
- dell/emc avamar · dell/emc integrated data protection appliance · vmware/vsphere data protection
- Source
- security_alert@emc.com
References
- http://www.securityfocus.com/bid/105972Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1042153Third Party Advisory, VDB Entry
- https://seclists.org/fulldisclosure/2018/Nov/50Mailing List, Third Party Advisory
- https://www.vmware.com/security/advisories/VMSA-2018-0029.htmlPatch, Third Party Advisory
- http://www.securityfocus.com/bid/105972Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1042153Third Party Advisory, VDB Entry
- https://seclists.org/fulldisclosure/2018/Nov/50Mailing List, Third Party Advisory
- https://www.vmware.com/security/advisories/VMSA-2018-0029.htmlPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.