Sign-up

ID

VAR-202111-1837


CVE

CVE-2021-36316


TITLE

Dell EMC Avamar Server  Vulnerability in privilege management in

Trust: 0.8

sources: JVNDB: JVNDB-2021-017079

DESCRIPTION

Dell EMC Avamar Server versions 18.2, 19.1, 19.2, 19.3, and 19.4 contain an improper privilege management vulnerability in AUI. A malicious user with high privileges could potentially exploit this vulnerability, leading to the disclosure of the AUI info and performing some unauthorized operation on the AUI. (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2021-36316 // JVNDB: JVNDB-2021-017079 // VULHUB: VHN-398200 // VULMON: CVE-2021-36316

AFFECTED PRODUCTS

vendor:dellmodel:emc avamar serverscope:eqversion:18.2

Trust: 1.0

vendor:dellmodel:emc avamar serverscope:eqversion:19.1

Trust: 1.0

vendor:dellmodel:emc avamar serverscope:eqversion:19.4

Trust: 1.0

vendor:dellmodel:emc avamar serverscope:eqversion:19.2

Trust: 1.0

vendor:dellmodel:emc avamar serverscope:eqversion:19.3

Trust: 1.0

vendor:デルmodel:dell emc avamar serverscope:eqversion: -

Trust: 0.8

vendor:デルmodel:dell emc avamar serverscope:eqversion:18.2

Trust: 0.8

vendor:デルmodel:dell emc avamar serverscope:eqversion:19.2

Trust: 0.8

vendor:デルmodel:dell emc avamar serverscope:eqversion:19.1

Trust: 0.8

vendor:デルmodel:dell emc avamar serverscope:eqversion:19.3

Trust: 0.8

vendor:デルmodel:dell emc avamar serverscope:eqversion:19.4

Trust: 0.8

sources: JVNDB: JVNDB-2021-017079 // NVD: CVE-2021-36316

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-36316
value: HIGH

Trust: 1.0

security_alert@emc.com: CVE-2021-36316
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-36316
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202111-984
value: HIGH

Trust: 0.6

VULHUB: VHN-398200
value: MEDIUM

Trust: 0.1

VULMON: CVE-2021-36316
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-36316
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-398200
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-36316
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.1

Trust: 1.0

security_alert@emc.com: CVE-2021-36316
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.5
version: 3.1

Trust: 1.0

NVD: CVE-2021-36316
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-398200 // VULMON: CVE-2021-36316 // JVNDB: JVNDB-2021-017079 // CNNVD: CNNVD-202111-984 // NVD: CVE-2021-36316 // NVD: CVE-2021-36316

PROBLEMTYPE DATA

problemtype:CWE-269

Trust: 1.1

problemtype:Improper authority management (CWE-269) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-398200 // JVNDB: JVNDB-2021-017079 // NVD: CVE-2021-36316

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202111-984

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202111-984

PATCH

title:DSA-2021-204url:https://www.dell.com/support/kbdoc/000193369

Trust: 0.8

sources: JVNDB: JVNDB-2021-017079

EXTERNAL IDS

db:NVDid:CVE-2021-36316

Trust: 3.4

db:JVNDBid:JVNDB-2021-017079

Trust: 0.8

db:CNNVDid:CNNVD-202111-984

Trust: 0.6

db:VULHUBid:VHN-398200

Trust: 0.1

db:VULMONid:CVE-2021-36316

Trust: 0.1

sources: VULHUB: VHN-398200 // VULMON: CVE-2021-36316 // JVNDB: JVNDB-2021-017079 // CNNVD: CNNVD-202111-984 // NVD: CVE-2021-36316

REFERENCES

url:https://www.dell.com/support/kbdoc/000193369

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2021-36316

Trust: 1.4

url:https://vigilance.fr/vulnerability/dell-emc-avamar-three-vulnerabilities-36846

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/269.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-398200 // VULMON: CVE-2021-36316 // JVNDB: JVNDB-2021-017079 // CNNVD: CNNVD-202111-984 // NVD: CVE-2021-36316

SOURCES

db:VULHUBid:VHN-398200
db:VULMONid:CVE-2021-36316
db:JVNDBid:JVNDB-2021-017079
db:CNNVDid:CNNVD-202111-984
db:NVDid:CVE-2021-36316

LAST UPDATE DATE

2024-08-14T14:18:13.867000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-398200date:2022-01-05T00:00:00
db:VULMONid:CVE-2021-36316date:2022-01-05T00:00:00
db:JVNDBid:JVNDB-2021-017079date:2022-12-28T07:17:00
db:CNNVDid:CNNVD-202111-984date:2022-01-06T00:00:00
db:NVDid:CVE-2021-36316date:2022-01-05T16:19:24.930

SOURCES RELEASE DATE

db:VULHUBid:VHN-398200date:2021-12-21T00:00:00
db:VULMONid:CVE-2021-36316date:2021-12-21T00:00:00
db:JVNDBid:JVNDB-2021-017079date:2022-12-28T00:00:00
db:CNNVDid:CNNVD-202111-984date:2021-11-10T00:00:00
db:NVDid:CVE-2021-36316date:2021-12-21T17:15:07.983