CVE-2018-9074 - Vulnerability Details

Vendors	Products
Lenovo	Iomega Ez Media \& Backup Center Iomega Storcenter Ix2 Iomega Storcenter Ix2-dl Iomega Storcenter Ix4-300d Iomega Storcenter Px12-400r Iomega Storcenter Px12-450r Iomega Storcenter Px2-300d Iomega Storcenter Px4-300d Iomega Storcenter Px4-300r Iomega Storcenter Px6-300d Lenovo Ez Media \& Backup Center Lenovo Ix2 Lenovo Ix4-300d Lenovoemc Firmware Lenovoemc Px12-400r Lenovoemc Px12-450r Lenovoemc Px2-300d Lenovoemc Px4-300d Lenovoemc Px4-300r Lenovoemc Px4-400d Lenovoemc Px4-400r Lenovoemc Px6-300d

Link	Providers
https://support.lenovo.com/us/en/solutions/LEN-24224

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Iomega StorCenter", "vendor": "Lenovo Group LTD", "versions": [{"lessThanOrEqual": "4.1.402.34662", "status": "affected", "version": "4.1.402.34662", "versionType": "custom"}]}, {"product": "LenovoEMC", "vendor": "Lenovo Group LTD", "versions": [{"lessThanOrEqual": "4.1.402.34662", "status": "affected", "version": "4.1.402.34662", "versionType": "custom"}]}, {"product": "EZ Media and Backup Center", "vendor": "Lenovo Group LTD", "versions": [{"lessThanOrEqual": "4.1.402.34662", "status": "affected", "version": "4.1.402.34662", "versionType": "custom"}]}], "datePublic": "2018-09-20T00:00:00", "descriptions": [{"lang": "en", "value": "For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file upload functionality of the Content Explorer application is vulnerable to path traversal. As a result, users can upload files anywhere on the device's operating system as the root user."}], "problemTypes": [{"descriptions": [{"description": "Path traversal", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-09-28T19:57:01", "orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "shortName": "lenovo"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://support.lenovo.com/us/en/solutions/LEN-24224"}], "source": {"advisory": "https://support.lenovo.com/us/en/solutions/LEN-24224", "discovery": "UNKNOWN"}, "title": "Iomega and LenovoEMC NAS Web UI Vulnerabilities", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@lenovo.com", "ID": "CVE-2018-9074", "STATE": "PUBLIC", "TITLE": "Iomega and LenovoEMC NAS Web UI Vulnerabilities"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Iomega StorCenter", "version": {"version_data": [{"affected": "<=", "version_affected": "<=", "version_name": "4.1.402.34662", "version_value": "4.1.402.34662"}]}}, {"product_name": "LenovoEMC", "version": {"version_data": [{"affected": "<=", "version_affected": "<=", "version_name": "4.1.402.34662", "version_value": "4.1.402.34662"}]}}, {"product_name": "EZ Media and Backup Center", "version": {"version_data": [{"affected": "<=", "version_affected": "<=", "version_name": "4.1.402.34662", "version_value": "4.1.402.34662"}]}}]}, "vendor_name": "Lenovo Group LTD"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file upload functionality of the Content Explorer application is vulnerable to path traversal. As a result, users can upload files anywhere on the device's operating system as the root user."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Path traversal"}]}]}, "references": {"reference_data": [{"name": "https://support.lenovo.com/us/en/solutions/LEN-24224", "refsource": "CONFIRM", "url": "https://support.lenovo.com/us/en/solutions/LEN-24224"}]}, "source": {"advisory": "https://support.lenovo.com/us/en/solutions/LEN-24224", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T07:17:50.355Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.lenovo.com/us/en/solutions/LEN-24224"}]}]}, "cveMetadata": {"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "assignerShortName": "lenovo", "cveId": "CVE-2018-9074", "datePublished": "2018-09-28T20:00:00", "dateReserved": "2018-03-27T00:00:00", "dateUpdated": "2024-08-05T07:17:50.355Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Iomega StorCenter (string)

vendor : Lenovo Group LTD (string)

versions : [ »

0 : { »

lessThanOrEqual : 4.1.402.34662 (string)

status : affected (string)

version : 4.1.402.34662 (string)

versionType : custom (string)

}

]

}

1 : { »

product : LenovoEMC (string)

vendor : Lenovo Group LTD (string)

versions : [ »

0 : { »

lessThanOrEqual : 4.1.402.34662 (string)

status : affected (string)

version : 4.1.402.34662 (string)

versionType : custom (string)

}

]

}

2 : { »

product : EZ Media and Backup Center (string)

vendor : Lenovo Group LTD (string)

versions : [ »

0 : { »

lessThanOrEqual : 4.1.402.34662 (string)

status : affected (string)

version : 4.1.402.34662 (string)

versionType : custom (string)

}

]

}

]

datePublic : 2018-09-20T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file upload functionality of the Content Explorer application is vulnerable to path traversal. As a result, users can upload files anywhere on the device's operating system as the root user. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Path traversal (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2018-09-28T19:57:01 (string)

orgId : da227ddf-6e25-4b41-b023-0f976dcaca4b (string)

shortName : lenovo (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://support.lenovo.com/us/en/solutions/LEN-24224 (string)

}

]

source : { »

advisory : https://support.lenovo.com/us/en/solutions/LEN-24224 (string)

discovery : UNKNOWN (string)

}

title : Iomega and LenovoEMC NAS Web UI Vulnerabilities (string)

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : psirt@lenovo.com (string)

ID : CVE-2018-9074 (string)

STATE : PUBLIC (string)

TITLE : Iomega and LenovoEMC NAS Web UI Vulnerabilities (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Iomega StorCenter (string)

version : { »

version_data : [ »

0 : { »

affected : <= (string)

version_affected : <= (string)

version_name : 4.1.402.34662 (string)

version_value : 4.1.402.34662 (string)

}

]

}

1 : { »

product_name : LenovoEMC (string)

version : { »

version_data : [ »

0 : { »

affected : <= (string)

version_affected : <= (string)

version_name : 4.1.402.34662 (string)

version_value : 4.1.402.34662 (string)

}

]

}

2 : { »

product_name : EZ Media and Backup Center (string)

version : { »

version_data : [ »

0 : { »

affected : <= (string)

version_affected : <= (string)

version_name : 4.1.402.34662 (string)

version_value : 4.1.402.34662 (string)

}

]

}

]

}

vendor_name : Lenovo Group LTD (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file upload functionality of the Content Explorer application is vulnerable to path traversal. As a result, users can upload files anywhere on the device's operating system as the root user. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Path traversal (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://support.lenovo.com/us/en/solutions/LEN-24224 (string)

refsource : CONFIRM (string)

url : https://support.lenovo.com/us/en/solutions/LEN-24224 (string)

}

]

}

source : { »

advisory : https://support.lenovo.com/us/en/solutions/LEN-24224 (string)

discovery : UNKNOWN (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T07:17:50.355Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://support.lenovo.com/us/en/solutions/LEN-24224 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : da227ddf-6e25-4b41-b023-0f976dcaca4b (string)

assignerShortName : lenovo (string)

cveId : CVE-2018-9074 (string)

datePublished : 2018-09-28T20:00:00 (string)

dateReserved : 2018-03-27T00:00:00 (string)

dateUpdated : 2024-08-05T07:17:50.355Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:lenovoemc_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "807B7582-8A34-4497-A2D7-BEF260790FD1", "versionEndIncluding": "4.1.402.34662", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:iomega_ez_media_\\&_backup_center:-:*:*:*:*:*:*:*", "matchCriteriaId": "76CDC771-1E75-4FA2-ACAD-6B76A3B41E87", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:iomega_storcenter_ix2:-:*:*:*:*:*:*:*", "matchCriteriaId": "2C6174F7-8D2C-4EA2-84B5-2F336C4921D3", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:iomega_storcenter_ix2-dl:-:*:*:*:*:*:*:*", "matchCriteriaId": "E19F81E4-64E2-42F3-8BF9-0E0B2C4B901B", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:iomega_storcenter_ix4-300d:-:*:*:*:*:*:*:*", "matchCriteriaId": "FDCCCF7E-0A84-44DC-A48B-577183A4BA7C", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:iomega_storcenter_px12-400r:-:*:*:*:*:*:*:*", "matchCriteriaId": "D840F199-8607-470E-9AE9-97459C041C11", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:iomega_storcenter_px12-450r:-:*:*:*:*:*:*:*", "matchCriteriaId": "0ED64A7B-B398-4A21-A93A-17C9CF9D6AC8", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:iomega_storcenter_px2-300d:-:*:*:*:*:*:*:*", "matchCriteriaId": "B10F7589-A7F5-4CA3-A959-0FC457EC605D", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:iomega_storcenter_px4-300d:-:*:*:*:*:*:*:*", "matchCriteriaId": "179EC0F5-606D-4DC2-898A-D243AB12680F", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:iomega_storcenter_px4-300r:-:*:*:*:*:*:*:*", "matchCriteriaId": "D74B9A44-814D-4415-BC82-0C3BE0E6FCF1", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:iomega_storcenter_px6-300d:-:*:*:*:*:*:*:*", "matchCriteriaId": "EF84CD08-A8D6-4C6E-9A4C-BC32981EF8C9", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:lenovo_ez_media_\\&_backup_center:-:*:*:*:*:*:*:*", "matchCriteriaId": "9C52F618-C9B0-470B-96BB-3BFB01797D47", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:lenovo_ix2:-:*:*:*:*:*:*:*", "matchCriteriaId": "ED38E2D0-50BE-4D0F-AD79-BCC14FBF17E7", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:lenovo_ix4-300d:-:*:*:*:*:*:*:*", "matchCriteriaId": "39F19015-369E-41F4-A543-7B56C08194B3", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:lenovoemc_px12-400r:-:*:*:*:*:*:*:*", "matchCriteriaId": "6A437398-827A-4A22-AC7B-984BABEE328A", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:lenovoemc_px12-450r:-:*:*:*:*:*:*:*", "matchCriteriaId": "24C29B73-FC3B-4440-B75B-7454E8AE5403", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:lenovoemc_px2-300d:-:*:*:*:*:*:*:*", "matchCriteriaId": "AE20E31A-28B9-4186-B3D0-60619799E8B1", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:lenovoemc_px4-300d:-:*:*:*:*:*:*:*", "matchCriteriaId": "BA4AD8BC-4BCA-4850-8058-AE4B669A4C89", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:lenovoemc_px4-300r:-:*:*:*:*:*:*:*", "matchCriteriaId": "014B2DE3-3012-4821-8CC8-A90474C95DA7", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:lenovoemc_px4-400d:-:*:*:*:*:*:*:*", "matchCriteriaId": "DC2EB779-CFAA-45BB-8D4B-DD6CFB31A34A", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:lenovoemc_px4-400r:-:*:*:*:*:*:*:*", "matchCriteriaId": "1C208CA2-2928-43FC-8477-895738579855", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:lenovoemc_px6-300d:-:*:*:*:*:*:*:*", "matchCriteriaId": "0AD5BFDB-E0A0-4C36-8102-05D5F0DAA87D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file upload functionality of the Content Explorer application is vulnerable to path traversal. As a result, users can upload files anywhere on the device's operating system as the root user."}, {"lang": "es", "value": "Para algunos dispositivos NAS Iomega, Lenovo y LenovoEMC en versiones 4.1.402.34662 y anteriores, la funcionalidad de subida de archivos de la aplicaci\u00f3n Content Explorer es vulnerable a salto de directorio. Como resultado, los usuarios pueden subir archivos en cualquier parte del sistema operativo del dispositivo como usuario root."}], "id": "CVE-2018-9074", "lastModified": "2024-11-21T04:14:55.240", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 6.8, "confidentialityImpact": "NONE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:N/I:C/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-09-28T20:29:00.643", "references": [{"source": "psirt@lenovo.com", "tags": ["Vendor Advisory"], "url": "https://support.lenovo.com/us/en/solutions/LEN-24224"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.lenovo.com/us/en/solutions/LEN-24224"}], "sourceIdentifier": "psirt@lenovo.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:lenovo:lenovoemc_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 807B7582-8A34-4497-A2D7-BEF260790FD1 (string)

versionEndIncluding : 4.1.402.34662 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:lenovo:iomega_ez_media_\&_backup_center:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 76CDC771-1E75-4FA2-ACAD-6B76A3B41E87 (string)

vulnerable : false (boolean)

}

1 : { »

criteria : cpe:2.3:h:lenovo:iomega_storcenter_ix2:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 2C6174F7-8D2C-4EA2-84B5-2F336C4921D3 (string)

vulnerable : false (boolean)

}

2 : { »

criteria : cpe:2.3:h:lenovo:iomega_storcenter_ix2-dl:-:*:*:*:*:*:*:* (string)

matchCriteriaId : E19F81E4-64E2-42F3-8BF9-0E0B2C4B901B (string)

vulnerable : false (boolean)

}

3 : { »

criteria : cpe:2.3:h:lenovo:iomega_storcenter_ix4-300d:-:*:*:*:*:*:*:* (string)

matchCriteriaId : FDCCCF7E-0A84-44DC-A48B-577183A4BA7C (string)

vulnerable : false (boolean)

}

4 : { »

criteria : cpe:2.3:h:lenovo:iomega_storcenter_px12-400r:-:*:*:*:*:*:*:* (string)

matchCriteriaId : D840F199-8607-470E-9AE9-97459C041C11 (string)

vulnerable : false (boolean)

}

5 : { »

criteria : cpe:2.3:h:lenovo:iomega_storcenter_px12-450r:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 0ED64A7B-B398-4A21-A93A-17C9CF9D6AC8 (string)

vulnerable : false (boolean)

}

6 : { »

criteria : cpe:2.3:h:lenovo:iomega_storcenter_px2-300d:-:*:*:*:*:*:*:* (string)

matchCriteriaId : B10F7589-A7F5-4CA3-A959-0FC457EC605D (string)

vulnerable : false (boolean)

}

7 : { »

criteria : cpe:2.3:h:lenovo:iomega_storcenter_px4-300d:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 179EC0F5-606D-4DC2-898A-D243AB12680F (string)

vulnerable : false (boolean)

}

8 : { »

criteria : cpe:2.3:h:lenovo:iomega_storcenter_px4-300r:-:*:*:*:*:*:*:* (string)

matchCriteriaId : D74B9A44-814D-4415-BC82-0C3BE0E6FCF1 (string)

vulnerable : false (boolean)

}

9 : { »

criteria : cpe:2.3:h:lenovo:iomega_storcenter_px6-300d:-:*:*:*:*:*:*:* (string)

matchCriteriaId : EF84CD08-A8D6-4C6E-9A4C-BC32981EF8C9 (string)

vulnerable : false (boolean)

}

10 : { »

criteria : cpe:2.3:h:lenovo:lenovo_ez_media_\&_backup_center:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 9C52F618-C9B0-470B-96BB-3BFB01797D47 (string)

vulnerable : false (boolean)

}

11 : { »

criteria : cpe:2.3:h:lenovo:lenovo_ix2:-:*:*:*:*:*:*:* (string)

matchCriteriaId : ED38E2D0-50BE-4D0F-AD79-BCC14FBF17E7 (string)

vulnerable : false (boolean)

}

12 : { »

criteria : cpe:2.3:h:lenovo:lenovo_ix4-300d:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 39F19015-369E-41F4-A543-7B56C08194B3 (string)

vulnerable : false (boolean)

}

13 : { »

criteria : cpe:2.3:h:lenovo:lenovoemc_px12-400r:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 6A437398-827A-4A22-AC7B-984BABEE328A (string)

vulnerable : false (boolean)

}

14 : { »

criteria : cpe:2.3:h:lenovo:lenovoemc_px12-450r:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 24C29B73-FC3B-4440-B75B-7454E8AE5403 (string)

vulnerable : false (boolean)

}

15 : { »

criteria : cpe:2.3:h:lenovo:lenovoemc_px2-300d:-:*:*:*:*:*:*:* (string)

matchCriteriaId : AE20E31A-28B9-4186-B3D0-60619799E8B1 (string)

vulnerable : false (boolean)

}

16 : { »

criteria : cpe:2.3:h:lenovo:lenovoemc_px4-300d:-:*:*:*:*:*:*:* (string)

matchCriteriaId : BA4AD8BC-4BCA-4850-8058-AE4B669A4C89 (string)

vulnerable : false (boolean)

}

17 : { »

criteria : cpe:2.3:h:lenovo:lenovoemc_px4-300r:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 014B2DE3-3012-4821-8CC8-A90474C95DA7 (string)

vulnerable : false (boolean)

}

18 : { »

criteria : cpe:2.3:h:lenovo:lenovoemc_px4-400d:-:*:*:*:*:*:*:* (string)

matchCriteriaId : DC2EB779-CFAA-45BB-8D4B-DD6CFB31A34A (string)

vulnerable : false (boolean)

}

19 : { »

criteria : cpe:2.3:h:lenovo:lenovoemc_px4-400r:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 1C208CA2-2928-43FC-8477-895738579855 (string)

vulnerable : false (boolean)

}

20 : { »

criteria : cpe:2.3:h:lenovo:lenovoemc_px6-300d:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 0AD5BFDB-E0A0-4C36-8102-05D5F0DAA87D (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file upload functionality of the Content Explorer application is vulnerable to path traversal. As a result, users can upload files anywhere on the device's operating system as the root user. (string)

}

1 : { »

lang : es (string)

value : Para algunos dispositivos NAS Iomega, Lenovo y LenovoEMC en versiones 4.1.402.34662 y anteriores, la funcionalidad de subida de archivos de la aplicación Content Explorer es vulnerable a salto de directorio. Como resultado, los usuarios pueden subir archivos en cualquier parte del sistema operativo del dispositivo como usuario root. (string)

}

]

id : CVE-2018-9074 (string)

lastModified : 2024-11-21T04:14:55.240 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : SINGLE (string)

availabilityImpact : NONE (string)

baseScore : 6.8 (number)

confidentialityImpact : NONE (string)

integrityImpact : COMPLETE (string)

vectorString : AV:N/AC:L/Au:S/C:N/I:C/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 8 (number)

impactScore : 6.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2018-09-28T20:29:00.643 (string)

references : [ »

0 : { »

source : psirt@lenovo.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.lenovo.com/us/en/solutions/LEN-24224 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.lenovo.com/us/en/solutions/LEN-24224 (string)

}

]

sourceIdentifier : psirt@lenovo.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-22 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Complete

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Complete

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object