CVE-2016-6648
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
In EMC RecoverPoint before 4.4.1.1 and EMC RecoverPoint for Virtual Machines before 5.0, a sensitive information disclosure vulnerability exists due to incorrect permissions on a system file. A malicious administrator with configuration privileges may access this file and compromise the system.
Risk Assessment
The risk involves potential exposure of sensitive system data by a privileged administrator, which could lead to privilege escalation or further attacks on the infrastructure.
Recommendation
Immediately update EMC RecoverPoint to version 4.4.1.1 or later, and EMC RecoverPoint for Virtual Machines to version 5.0 or later. Additionally, review and correct permissions on system files.
Other vulnerabilities in EMC RecoverPoint
See all- CVE-2016-6650High
An SSL Stripping vulnerability in EMC RecoverPoint versions prior to 5.0 and EMC RecoverPoint for Virtual Machines versions prior to 5.0 allows attackers to intercept and modify SSL traffic, potentially compromising the affected system.
- CVE-2016-6649Medium
EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0 contain multiple command injection vulnerabilities. A malicious administrator with configuration privileges may bypass the user interface and escalate privileges to root.
Original NVD description (English source)
EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0 are affected by sensitive information disclosure vulnerability as a result of incorrect permissions set on a sensitive system file. A malicious administrator with configuration privileges may access this sensitive system file and compromise the affected system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS