All the vulnerabilites related to VMware - NSX SD-WAN by VeloCloud
cve-2018-6961
Vulnerability from cvelistv5
Published
2018-06-11 22:00
Modified
2024-09-17 01:36
Severity ?
EPSS score ?
Summary
VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution.
References
▼ | URL | Tags |
---|---|---|
http://www.securityfocus.com/bid/104185 | vdb-entry, x_refsource_BID | |
https://www.exploit-db.com/exploits/44959/ | exploit, x_refsource_EXPLOIT-DB | |
http://www.securitytracker.com/id/1041210 | vdb-entry, x_refsource_SECTRACK | |
http://www.vmware.com/security/advisories/VMSA-2018-0011.html | x_refsource_CONFIRM |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | VMware | NSX SD-WAN by VeloCloud |
Version: prior to version 3.1.0 |
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T06:17:17.275Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "104185", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/104185" }, { "name": "44959", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "url": "https://www.exploit-db.com/exploits/44959/" }, { "name": "1041210", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "url": "http://www.securitytracker.com/id/1041210" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.vmware.com/security/advisories/VMSA-2018-0011.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "NSX SD-WAN by VeloCloud", "vendor": "VMware", "versions": [ { "status": "affected", "version": "prior to version 3.1.0" } ] } ], "datePublic": "2018-06-11T00:00:00", "descriptions": [ { "lang": "en", "value": "VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution." } ], "problemTypes": [ { "descriptions": [ { "description": "Command Injection", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2018-07-04T09:57:01", "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware" }, "references": [ { "name": "104185", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/104185" }, { "name": "44959", "tags": [ "exploit", "x_refsource_EXPLOIT-DB" ], "url": "https://www.exploit-db.com/exploits/44959/" }, { "name": "1041210", "tags": [ "vdb-entry", "x_refsource_SECTRACK" ], "url": "http://www.securitytracker.com/id/1041210" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.vmware.com/security/advisories/VMSA-2018-0011.html" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security@vmware.com", "DATE_PUBLIC": "2018-06-11T00:00:00", "ID": "CVE-2018-6961", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "NSX SD-WAN by VeloCloud", "version": { "version_data": [ { "version_value": "prior to version 3.1.0" } ] } } ] }, "vendor_name": "VMware" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Command Injection" } ] } ] }, "references": { "reference_data": [ { "name": "104185", "refsource": "BID", "url": "http://www.securityfocus.com/bid/104185" }, { "name": "44959", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/44959/" }, { "name": "1041210", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1041210" }, { "name": "http://www.vmware.com/security/advisories/VMSA-2018-0011.html", "refsource": "CONFIRM", "url": "http://www.vmware.com/security/advisories/VMSA-2018-0011.html" } ] } } } }, "cveMetadata": { "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "assignerShortName": "vmware", "cveId": "CVE-2018-6961", "datePublished": "2018-06-11T22:00:00Z", "dateReserved": "2018-02-14T00:00:00", "dateUpdated": "2024-09-17T01:36:00.106Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }