CVE-2018-11077 is an OS command injection vulnerability in the 'getlogs' utility of Dell EMC Avamar Server (versions 7.2.0 through 18.1) and Dell EMC Integrated Data Protection Appliance (versions 2.0 through 2.2). A highly privileged malicious Avamar administrator could exploit this flaw to execute arbitrary commands with root privileges. Rated Medium severity (CVSS 6.7), this vulnerability requires high privileges and local access, but successful exploitation leads to complete compromise of confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code, or significant community discussion, though it did receive limited media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
7.2.0CPE matchmatch criteria | cpe:2.3:a:dell:emc_avamar:7.2.0:*:*:*:*:*:*:* | ||
7.2.1CPE matchmatch criteria | cpe:2.3:a:dell:emc_avamar:7.2.1:*:*:*:*:*:*:* | ||
7.3.0CPE matchmatch criteria | cpe:2.3:a:dell:emc_avamar:7.3.0:*:*:*:*:*:*:* | ||
7.3.1CPE matchmatch criteria | cpe:2.3:a:dell:emc_avamar:7.3.1:*:*:*:*:*:*:* | ||
7.4.0CPE matchmatch criteria | cpe:2.3:a:dell:emc_avamar:7.4.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.