Improper input validation in Dell EMC Unisphere
CVE-2016-6646
The vApp Managers web application in EMC Unisphere for VMAX Virtual Appliance 8.x before 8.3.0 and Solutions Enabler Virtual Appliance 8.x before 8.3.0 allows remote attackers to execute arbitrary code via crafted input to the (1) GetSymmCmdRequest or (2) RemoteServiceHandler class.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.049 (91.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Dell Emc_unisphere — versions 8.0, 8.1, 8.1.2
- Emc Solutions_enabler — versions 8.0, 8.0.3, 8.1
- Emc Unisphere — versions 8.0.3
- N/a — versions n/a
Weakness classification (CWE)
References
- security_alert@emc.com (mailing-list, x_refsource_BUGTRAQ, Third Party Advisory)
- security_alert@emc.com (vdb-entry, x_refsource_SECTRACK)
- security_alert@emc.com (vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2016-6646?
- CVE-2016-6646 is a critical-severity vulnerability in Dell EMC Unisphere, classified under Improper Input Validation. CVSS score: 9.8/10. Published 2016-10-05.
- How severe is CVE-2016-6646?
- Critical severity. CVSS v3 base score is 9.8 out of 10.