CVE-2017-8134
HighSummary
FusionSphere OpenStack versions V100R006C00 and V100R006C10 have a command injection vulnerability due to insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending malicious commands.
Risk Assessment
This vulnerability poses a serious risk to organizations, allowing attackers to gain full control over the system. It may lead to data loss, privacy breaches, and other severe security incidents.
Recommendation
It is recommended to immediately update FusionSphere OpenStack to the latest version that addresses this vulnerability. Additionally, implementing further security measures, such as firewalls, to restrict access to the vulnerable ports is advisable.
Other vulnerabilities in FusionSphere OpenStack
See all- CVE-2017-8135High
FusionSphere OpenStack versions V100R006C00 and V100R006C10 have a command injection vulnerability due to insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit this vulnerability to gain root privileges by sending malicious commands.
- CVE-2017-8132High
FusionSphere OpenStack versions V100R006C00 and V100R006C10 have a command injection vulnerability due to insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit these vulnerabilities to gain root privileges by sending malicious commands.
- CVE-2017-8131High
FusionSphere OpenStack versions V100R006C00 and V100R006C10 have a command injection vulnerability due to insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit this vulnerability by sending malicious commands to gain root privileges.
- CVE-2017-2719High
FusionSphere OpenStack versions V100R006C00 and V100R006C10RC2 have two command injection vulnerabilities due to insufficient input validation on one port. An attacker can exploit these vulnerabilities to gain root privileges by sending messages with malicious commands.
- CVE-2017-2718High
FusionSphere OpenStack versions V100R006C00 and V100R006C10RC2 have two command injection vulnerabilities due to insufficient input validation on one port. An attacker can exploit these vulnerabilities to gain root privileges by sending messages with malicious commands.
Original NVD description (English source)
The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands.