Security Advisory - Information Leak Vulnerability in FusionCompute Products
- SA No:Huawei-SA-20151125-01- FusionCompute
- Initial Release Date: Nov 25, 2015
- Last Release Date: Nov 25, 2015
There is a vulnerability in FusionCompute that enables common users to query unauthorized information. An attacker can exploit this vulnerability to query other users' information, leading to information leaks. (Vulnerability ID: HWPSIRT-2015-10048)
This vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2015-8336.
Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:
http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-462904.htm
|
Product Name |
Affected Version |
Resolved Product and Version |
|
FusionCompute |
V100R003C10 |
Upgrade to V100R005C10SPC700 |
|
V100R003C00 |
An attacker can exploit this vulnerability to query other users' information, leading to information leaks.
The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).
Base Score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
Temporal Score: 3.3 (E:F/RL:O/RC:C)
1. Prerequisite:
The attacker gains access to the FusionCompute network;
2. Attacking procedure:
The attacker logs in to the management page of FusionCompute using the common user' account and password. Then the attacker can query other users' role and permission information which should be accessible only to administrators, leading to information leaks.
This vulnerability was discovered by Huawei internal tester.
For security problems about Huawei products and solutions, please contactPSIRT@huawei.com.
For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.
2015-11-25 V1.0 INITIAL
None
