RCE in Emc Isilon Onefs

CVE-2015-4525

The log-gather implementation in the web administration interface in EMC Isilon OneFS 6.5.x.x through 7.1.1.x before 7.1.1.5 and 7.2.0.x before 7.2.0.2 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.022 (80.7th percentile) — read the EPSS interpretation.

Affected products

Emc Isilon_onefs — versions 7.1.1.1, 7.1.1.2, 7.1.1.3
N/a — versions n/a

Weakness classification (CWE)

CWE-77 — Command Injection

References

security_alert@emc.com (mailing-list, x_refsource_BUGTRAQ)