huawei fusionsphere_openstack Security Vulnerabilities

19 Vulnerabilities

Description
FusionSphere OpenStack with software V100R006C00SPC102(NFV) and V100R006C10 have an information leak vulnerability. Due to an incorrect configuration item, the information transmitted by a transmission channel is not encrypted. An attacker accessing the internal network may obtain sensitive information transmitted. Impacted versions: v100r006c00spc102\(nfv\), v100r006c10 Base Score: 3.3, Severity: LOW, ID: CVE-2017-8168, Last Modified: 2019-10-03T00:03:00Z References Vendor Advisory
FusionSphere OpenStack V100R006C00 has an improper authorization vulnerability. Due to improper authorization, an attacker with low privilege may exploit this vulnerability to obtain the operation authority of some specific directory, causing privilege escalation. Impacted versions: v100r006c00 Base Score: 4.6, Severity: MEDIUM, ID: CVE-2017-8192, Last Modified: 2019-10-03T00:03:00Z References Vendor Advisory
FusionSphere OpenStack V100R006C00 has an information exposure vulnerability. The software uses hard-coded cryptographic key to encrypt messages between certain components, which significantly increases the possibility that encrypted data may be recovered and results in information exposure. Impacted versions: v100r006c00 Base Score: 5.0, Severity: MEDIUM, ID: CVE-2017-2720, Last Modified: 2019-10-03T00:03:00Z References Vendor Advisory
There is an information leakage vulnerability on several Huawei products. Due to insufficient communication protection for specific services, a remote, unauthorized attacker can exploit this vulnerability to connect to specific services to obtain additional information. Successful exploitation of this vulnerability can lead to information leakage. Impacted versions: 100r006c00 Base Score: 5.0, Severity: MEDIUM, ID: CVE-2018-7977, Last Modified: 2018-12-20T15:34:00Z References Vendor Advisory
Huawei FusionSphere OpenStack V100R006C000SPC102 (NFV) has an information leak vulnerability due to the use of a low version transmission protocol by default. An attacker could intercept packets transferred by a target device. Successful exploit could cause an information leak. Impacted versions: v100r006c000spc102_\(nfv\) Base Score: 4.3, Severity: MEDIUM, ID: CVE-2017-15321, Last Modified: 2018-01-05T16:01:00Z References Vendor Advisory
FusionSphere OpenStack V100R006C00SPC102(NFV)has a week cryptographic algorithm vulnerability. Attackers may exploit the vulnerability to crack the cipher text and cause information leak on the transmission links. Impacted versions: v100r006c00spc102\(nfv\) Base Score: 4.3, Severity: MEDIUM, ID: CVE-2017-8191, Last Modified: 2017-12-29T02:29:00Z References Vendor Advisory
The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands. Impacted versions: v100r006c00, v100r006c10 Base Score: 8.3, Severity: HIGH, ID: CVE-2017-8135, Last Modified: 2017-12-27T17:08:00Z References Vendor Advisory
The FusionSphere OpenStack V100R006C00SPC102(NFV) has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message. Impacted versions: v100r006c00spc102\(nfv\) Base Score: 6.5, Severity: MEDIUM, ID: CVE-2017-8194, Last Modified: 2017-12-20T02:29:00Z References Vendor Advisory
The GaussDB in FusionSphere OpenStack V100R005C10SPC705 and earlier versions has a buffer overflow vulnerability. An authenticated attacker on the LAN can exploit this vulnerability to execute arbitrary code or cause a denial of service (DoS) condition in the affected system. Impacted versions: * Base Score: 7.7, Severity: HIGH, ID: CVE-2017-2714, Last Modified: 2017-12-08T19:14:00Z References Vendor Advisory
FusionSphere OpenStack with software V100R006C00 and V100R006C10RC2 has two command injection vulnerabilities due to the insufficient input validation on one port. An attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands. Impacted versions: v100r006c10rc2, v100r006c00 Base Score: 8.3, Severity: HIGH, ID: CVE-2017-2719, Last Modified: 2017-12-08T19:13:00Z References Vendor Advisory
FusionSphere OpenStack V100R006C00SPC102(NFV)has a command injection vulnerability. Due to lack of validation, an attacker with high privilege may inject malicious code into some module of the affected products, causing code execution. Impacted versions: v100r006c00spc102\(nfv\) Base Score: 6.5, Severity: MEDIUM, ID: CVE-2017-8188, Last Modified: 2017-12-08T19:06:00Z References Vendor Advisory
FusionSphere OpenStack V100R006C00SPC102(NFV)has a path traversal vulnerability. Due to insufficient path validation, an attacker with high privilege may exploit this vulnerability to cover some files, causing services abnormal. Impacted versions: v100r006c00spc102\(nfv\) Base Score: 3.6, Severity: LOW, ID: CVE-2017-8189, Last Modified: 2017-12-08T19:05:00Z References Vendor Advisory
FusionSphere OpenStack V100R006C00SPC102(NFV)has an improper verification of cryptographic signature vulnerability. The software does not verify the cryptographic signature. An attacker with high privilege may exploit this vulnerability to inject malicious software. Impacted versions: v100r006c00spc102\(nfv\) Base Score: 4.6, Severity: MEDIUM, ID: CVE-2017-8190, Last Modified: 2017-12-08T19:04:00Z References Vendor Advisory
The FusionSphere OpenStack V100R006C00SPC102(NFV) has a command injection vulnerability. Due to the insufficient input validation on one port, an authenticated, local attacker may exploit the vulnerability to gain root privileges by sending message with malicious commands. Impacted versions: v100r006c00spc102\(nfv\) Base Score: 7.7, Severity: HIGH, ID: CVE-2017-8193, Last Modified: 2017-12-08T18:16:00Z References Vendor Advisory
The FusionSphere OpenStack V100R006C00SPC102(NFV) has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message. Impacted versions: v100r006c00spc102\(nfv\) Base Score: 6.5, Severity: MEDIUM, ID: CVE-2017-8195, Last Modified: 2017-12-08T18:13:00Z References Vendor Advisory
The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands. Impacted versions: v100r006c10, v100r006c00 Base Score: 8.3, Severity: HIGH, ID: CVE-2017-8134, Last Modified: 2017-12-06T15:19:00Z References Vendor Advisory
The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands. Impacted versions: v100r006c10, v100r006c00 Base Score: 8.3, Severity: HIGH, ID: CVE-2017-8132, Last Modified: 2017-12-06T15:16:00Z References Vendor Advisory
The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands. Impacted versions: v100r006c00, v100r006c10 Base Score: 8.3, Severity: HIGH, ID: CVE-2017-8131, Last Modified: 2017-12-06T15:06:00Z References Vendor Advisory
FusionSphere OpenStack with software V100R006C00 and V100R006C10RC2 has two command injection vulnerabilities due to the insufficient input validation on one port. An attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands. Impacted versions: v100r006c00, v100r006c10rc2 Base Score: 8.3, Severity: HIGH, ID: CVE-2017-2718, Last Modified: 2017-12-05T17:03:00Z References Vendor Advisory

Description

FusionSphere OpenStack with software V100R006C00SPC102(NFV) and V100R006C10 have an information leak vulnerability. Due to an incorrect configuration item, the information transmitted by a transmission channel is not encrypted. An attacker accessing the internal network may obtain sensitive information transmitted.

Impacted versions: v100r006c00spc102\(nfv\), v100r006c10

Base Score: 3.3, Severity: LOW, ID: CVE-2017-8168, Last Modified: 2019-10-03T00:03:00Z

References

Vendor Advisory

FusionSphere OpenStack V100R006C00 has an improper authorization vulnerability. Due to improper authorization, an attacker with low privilege may exploit this vulnerability to obtain the operation authority of some specific directory, causing privilege escalation.

Impacted versions: v100r006c00

Base Score: 4.6, Severity: MEDIUM, ID: CVE-2017-8192, Last Modified: 2019-10-03T00:03:00Z

References

Vendor Advisory

FusionSphere OpenStack V100R006C00 has an information exposure vulnerability. The software uses hard-coded cryptographic key to encrypt messages between certain components, which significantly increases the possibility that encrypted data may be recovered and results in information exposure.

Impacted versions: v100r006c00

Base Score: 5.0, Severity: MEDIUM, ID: CVE-2017-2720, Last Modified: 2019-10-03T00:03:00Z

References

Vendor Advisory

There is an information leakage vulnerability on several Huawei products. Due to insufficient communication protection for specific services, a remote, unauthorized attacker can exploit this vulnerability to connect to specific services to obtain additional information. Successful exploitation of this vulnerability can lead to information leakage.

Impacted versions: 100r006c00

Base Score: 5.0, Severity: MEDIUM, ID: CVE-2018-7977, Last Modified: 2018-12-20T15:34:00Z

References

Vendor Advisory

Huawei FusionSphere OpenStack V100R006C000SPC102 (NFV) has an information leak vulnerability due to the use of a low version transmission protocol by default. An attacker could intercept packets transferred by a target device. Successful exploit could cause an information leak.

Impacted versions: v100r006c000spc102_\(nfv\)

Base Score: 4.3, Severity: MEDIUM, ID: CVE-2017-15321, Last Modified: 2018-01-05T16:01:00Z

References

Vendor Advisory

FusionSphere OpenStack V100R006C00SPC102(NFV)has a week cryptographic algorithm vulnerability. Attackers may exploit the vulnerability to crack the cipher text and cause information leak on the transmission links.

Impacted versions: v100r006c00spc102\(nfv\)

Base Score: 4.3, Severity: MEDIUM, ID: CVE-2017-8191, Last Modified: 2017-12-29T02:29:00Z

References

Vendor Advisory

The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands.

Impacted versions: v100r006c00, v100r006c10

Base Score: 8.3, Severity: HIGH, ID: CVE-2017-8135, Last Modified: 2017-12-27T17:08:00Z

References

Vendor Advisory

The FusionSphere OpenStack V100R006C00SPC102(NFV) has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message.

Impacted versions: v100r006c00spc102\(nfv\)

Base Score: 6.5, Severity: MEDIUM, ID: CVE-2017-8194, Last Modified: 2017-12-20T02:29:00Z

References

Vendor Advisory

The GaussDB in FusionSphere OpenStack V100R005C10SPC705 and earlier versions has a buffer overflow vulnerability. An authenticated attacker on the LAN can exploit this vulnerability to execute arbitrary code or cause a denial of service (DoS) condition in the affected system.

Impacted versions: *

Base Score: 7.7, Severity: HIGH, ID: CVE-2017-2714, Last Modified: 2017-12-08T19:14:00Z

References

Vendor Advisory

FusionSphere OpenStack with software V100R006C00 and V100R006C10RC2 has two command injection vulnerabilities due to the insufficient input validation on one port. An attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands.

Impacted versions: v100r006c10rc2, v100r006c00

Base Score: 8.3, Severity: HIGH, ID: CVE-2017-2719, Last Modified: 2017-12-08T19:13:00Z

References

Vendor Advisory

FusionSphere OpenStack V100R006C00SPC102(NFV)has a command injection vulnerability. Due to lack of validation, an attacker with high privilege may inject malicious code into some module of the affected products, causing code execution.

Impacted versions: v100r006c00spc102\(nfv\)

Base Score: 6.5, Severity: MEDIUM, ID: CVE-2017-8188, Last Modified: 2017-12-08T19:06:00Z

References

Vendor Advisory

FusionSphere OpenStack V100R006C00SPC102(NFV)has a path traversal vulnerability. Due to insufficient path validation, an attacker with high privilege may exploit this vulnerability to cover some files, causing services abnormal.

Impacted versions: v100r006c00spc102\(nfv\)

Base Score: 3.6, Severity: LOW, ID: CVE-2017-8189, Last Modified: 2017-12-08T19:05:00Z

References

Vendor Advisory

FusionSphere OpenStack V100R006C00SPC102(NFV)has an improper verification of cryptographic signature vulnerability. The software does not verify the cryptographic signature. An attacker with high privilege may exploit this vulnerability to inject malicious software.

Impacted versions: v100r006c00spc102\(nfv\)

Base Score: 4.6, Severity: MEDIUM, ID: CVE-2017-8190, Last Modified: 2017-12-08T19:04:00Z

References

Vendor Advisory

The FusionSphere OpenStack V100R006C00SPC102(NFV) has a command injection vulnerability. Due to the insufficient input validation on one port, an authenticated, local attacker may exploit the vulnerability to gain root privileges by sending message with malicious commands.

Impacted versions: v100r006c00spc102\(nfv\)

Base Score: 7.7, Severity: HIGH, ID: CVE-2017-8193, Last Modified: 2017-12-08T18:16:00Z

References

Vendor Advisory

Impacted versions: v100r006c00spc102\(nfv\)

Base Score: 6.5, Severity: MEDIUM, ID: CVE-2017-8195, Last Modified: 2017-12-08T18:13:00Z

References

Vendor Advisory

Impacted versions: v100r006c10, v100r006c00

Base Score: 8.3, Severity: HIGH, ID: CVE-2017-8134, Last Modified: 2017-12-06T15:19:00Z

References

Vendor Advisory

Impacted versions: v100r006c10, v100r006c00

Base Score: 8.3, Severity: HIGH, ID: CVE-2017-8132, Last Modified: 2017-12-06T15:16:00Z

References

Vendor Advisory

Impacted versions: v100r006c00, v100r006c10

Base Score: 8.3, Severity: HIGH, ID: CVE-2017-8131, Last Modified: 2017-12-06T15:06:00Z

References

Vendor Advisory

Impacted versions: v100r006c00, v100r006c10rc2

Base Score: 8.3, Severity: HIGH, ID: CVE-2017-2718, Last Modified: 2017-12-05T17:03:00Z

References

Vendor Advisory

USAGE: Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.