What is CVE-2018-1238?

CVE-2018-1238 is a high-severity vulnerability in Dell Emc Scaleio, classified under OS Command Injection. CVSS score: 7.5/10. Published 2018-03-27.

How severe is CVE-2018-1238?

High severity. CVSS v3 base score is 7.5 out of 10.

RCE in Dell Emc Scaleio

CVE-2018-1238

Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent (LIA). This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user, with network access to LIA and knowledge of the LIA administrative password, could potentially exploit this vulnerability to run arbitrary commands as root on the systems where LIAs are installed.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.015 (71.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Dell Emc_scaleio
Dell Emc Scaleio — versions versions prior to 2.5

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

security_alert@emc.com (mailing-list, x_refsource_FULLDISC, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2018-1238?: CVE-2018-1238 is a high-severity vulnerability in Dell Emc Scaleio, classified under OS Command Injection. CVSS score: 7.5/10. Published 2018-03-27.
How severe is CVE-2018-1238?: High severity. CVSS v3 base score is 7.5 out of 10.