CVEvulnerability

CVE-2019-18780

9.8 CRITICAL Published 2019-11-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-11-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-77

Description

An arbitrary command injection vulnerability in the Cluster Server component of Veritas InfoScale allows an unauthenticated remote attacker to execute arbitrary commands as root or administrator. These Veritas products are affected: Access 7.4.2 and earlier, Access Appliance 7.4.2 and earlier, Flex Appliance 1.2 and earlier, InfoScale 7.3.1 and earlier, InfoScale between 7.4.0 and 7.4.1, Veritas Cluster Server (VCS) 6.2.1 and earlier on Linux/UNIX, Veritas Cluster Server (VCS) 6.1 and earlier on Windows, Storage Foundation HA (SFHA) 6.2.1 and earlier on Linux/UNIX, and Storage Foundation HA (SFHA) 6.1 and earlier on Windows.

Affected configurations

• veritas access (<= 7.4.2) • veritas access appliance (<= 7.4.2) • veritas flex appliance (<= 1.2) • veritas infoscale (<= 7.3.1) • veritas infoscale (>= 7.4.0 <= 7.4.1) • veritas cluster server (<= 6.1) • veritas storage foundation ha (<= 6.1) • veritas cluster server (<= 6.2.1) • veritas storage foundation ha (<= 6.2.1)

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References