Unrestricted file upload in vApp Manager which is embedded in Dell EMC Unisphere for…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-434.
Summary
An arbitrary file upload vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement): Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.18, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.21, Dell EMC VASA Virtual Appliance versions prior to 8.4.0.514, and Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4 (Enginuity Release 5977.1125.1125 and earlier). A remote authenticated malicious user may potentially upload arbitrary maliciously crafted files in any location on the web server. By chaining this vulnerability with CVE-2018-1216, the attacker may use the default account to exploit this vulnerability.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement) | vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement) | — | No fix listed | CNA |
- vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement) Vendor— Affected vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement) Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dell:emc_solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:* | before 8.4.0.21 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_unisphere_for_vmax_virtual_appliance:*:*:*:*:*:*:*:* | before 8.4.0.18 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_vasa_virtual_appliance:*:*:*:*:*:*:*:* | before 8.4.0.514 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_vmax_embedded_management:*:*:*:*:*:*:*:* | up to 1.4 | Vulnerable | Dell |
- cpe:2.3:a:dell:emc_solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:* Versions before 8.4.0.21 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_unisphere_for_vmax_virtual_appliance:*:*:*:*:*:*:*:* Versions before 8.4.0.18 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_vasa_virtual_appliance:*:*:*:*:*:*:*:* Versions before 8.4.0.514 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_vmax_embedded_management:*:*:*:*:*:*:*:* Versions up to 1.4 Vulnerable ·Dell
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1215
- 2026-10-03 Alias added: GHSA-69qj-g89f-2x2j
References
More Dell Emc Solutions Enabler Virtual Appliance vulnerabilities
- TI-2018-01127 Hard-coded credentials in vApp Manager which is embedded in Dell EMC Unisphere for VMAX… CVSS 3.0CRITICAL 9.8
- TI-2018-01098 XML external entity injection in Dell EMC Unisphere for VMAX Virtual Appliance, Dell EMC… CVSS 3.0CRITICAL 9.8
- TI-2022-22192 Information disclosure in Dell Unisphere for PowerMax vApp CVSS 3.1MEDIUM 6.5
Sources
- CVE-2018-1215 · CVE Program
- CVE-2018-1215 · NVD
- FIRST EPSS
- GHSA-69qj-g89f-2x2j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences