{"containers": {"cna": {"affected": [{"product": "iDRAC ", "vendor": "Dell EMC", "versions": [{"lessThan": "2.61.60.60", "status": "affected", "version": "iDRAC7", "versionType": "custom"}, {"lessThan": "2.61.60.60", "status": "affected", "version": "iDRAC8", "versionType": "custom"}, {"changes": [{"at": "3.21.24.22", "status": "unaffected"}, {"at": "3.21.26.22", "status": "unaffected"}], "lessThan": "3.20.21.20", "status": "affected", "version": "iDRAC9", "versionType": "custom"}, {"lessThan": "3.23.23.23 ", "status": "affected", "version": "iDRAC9 ", "versionType": "custom"}]}], "datePublic": "2018-12-11T00:00:00", "descriptions": [{"lang": "en", "value": "Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 contain a privilege escalation vulnerability. An authenticated malicious iDRAC user with operator privileges could potentially exploit a permissions check flaw in the Redfish interface to gain administrator access."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Privilege escalation vulnerability. ", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-12-19T10:57:01", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en"}, {"name": "106233", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/106233"}], "source": {"discovery": "EXTERNAL"}, "title": "iDRAC7/iDRAC8/iDRAC9 - Privilege Escalation Vulnerability ", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security_alert@emc.com", "DATE_PUBLIC": "2018-12-11T06:00:00.000Z", "ID": "CVE-2018-15774", "STATE": "PUBLIC", "TITLE": "iDRAC7/iDRAC8/iDRAC9 - Privilege Escalation Vulnerability "}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "iDRAC ", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_name": "iDRAC7", "version_value": "2.61.60.60"}, {"affected": "<", "version_affected": "<", "version_name": "iDRAC8", "version_value": "2.61.60.60"}, {"affected": "<", "version_affected": "<", "version_name": "iDRAC9", "version_value": "3.20.21.20"}, {"affected": "<", "version_affected": "<", "version_name": "iDRAC9", "version_value": "3.21.24.22"}, {"affected": "<", "version_affected": "<", "version_name": "iDRAC9", "version_value": "3.21.26.22"}, {"affected": "<", "version_affected": "<", "version_name": "iDRAC9 ", "version_value": "3.23.23.23 "}]}}]}, "vendor_name": "Dell EMC"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 contain a privilege escalation vulnerability. An authenticated malicious iDRAC user with operator privileges could potentially exploit a permissions check flaw in the Redfish interface to gain administrator access."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Privilege escalation vulnerability. "}]}]}, "references": {"reference_data": [{"name": "https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en", "refsource": "CONFIRM", "url": "https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en"}, {"name": "106233", "refsource": "BID", "url": "http://www.securityfocus.com/bid/106233"}]}, "source": {"discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2018-15774", "datePublished": "2018-12-11T00:00:00", "dateReserved": "2018-08-23T00:00:00", "dateUpdated": "2018-12-19T10:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dell:idrac7_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "ACBCB009-3BF0-48D8-9F79-7466D3337F72", "versionEndExcluding": "2.61.60.60", "vulnerable": true}, {"criteria": "cpe:2.3:o:dell:idrac8_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B452829A-3012-44C8-B0EB-176CD61DEE07", "versionEndExcluding": "2.61.60.60", "vulnerable": true}, {"criteria": "cpe:2.3:o:dell:idrac9_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BCE2274-B3B1-4BA6-B01A-869258936FA0", "versionEndExcluding": "3.20.21.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:dell:idrac9_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B97B609B-9A8C-4421-BAE8-555D339BB2E3", "versionEndExcluding": "3.21.24.22", "versionStartIncluding": "3.21.21.21", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 contain a privilege escalation vulnerability. An authenticated malicious iDRAC user with operator privileges could potentially exploit a permissions check flaw in the Redfish interface to gain administrator access."}, {"lang": "es", "value": "Dell EMC iDRAC7/iDRAC8, en versiones anteriores a la 2.61.60.60, y iDRAC9 en versiones anteriores a la 3.20.21.20, 3.21.24.22, 3.21.26.22 y 3.23.23.23, contienen una vulnerabilidad de escalado de privilegios. Un usuario iDRAC malicioso autenticado con privilegios de operador podr\u00eda explotar un error de comprobaci\u00f3n de permisos en la interfaz Redfish para obtener acceso de administrador."}], "id": "CVE-2018-15774", "lastModified": "2019-10-09T23:35:52.893", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 1.2, "impactScore": 2.5, "source": "security_alert@emc.com", "type": "Secondary"}]}, "published": "2018-12-13T22:29:00.327", "references": [{"source": "security_alert@emc.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/106233"}, {"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}