« Volver al listado

CVE-2014-7180

Estado: ModificadaMedia (4.6)—

Electric Cloud ElectricCommander anterior a 4.2.6 y 5.x anterior a 5.0.3 utiliza permisos de escritura universal para (1) eccert.pl y (2) ecconfigure.pl, lo que permite a usuarios locales ejecutar código Perl arbitrario mediante la modificación de estos ficheros.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Electric Cloud — Electriccommander

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-7180",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-10-25T00:55:04.320",
  "references": [
    {
      "url": "http://docs.electric-cloud.com/commander_doc/5_0_3/HTML5/ReleaseNotes/commander_releasenotes.htm",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/128819/ElectricCommander-4.2.4.71224-Privilege-Escalation.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2014/Oct/104",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.secureworks.com/advisories/SWRX-2014-010/SWRX-2014-010.pdf",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.secureworks.com/cyber-threat-intelligence/advisories/SWRX-2014-010/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/70722",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/97735",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://docs.electric-cloud.com/commander_doc/5_0_3/HTML5/ReleaseNotes/commander_releasenotes.htm",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://packetstormsecurity.com/files/128819/ElectricCommander-4.2.4.71224-Privilege-Escalation.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2014/Oct/104",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.secureworks.com/advisories/SWRX-2014-010/SWRX-2014-010.pdf",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.secureworks.com/cyber-threat-intelligence/advisories/SWRX-2014-010/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/70722",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/97735",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2) ecconfigure.pl, which allows local users to execute arbitrary Perl code by modifying these files."
    },
    {
      "lang": "es",
      "value": "Electric Cloud ElectricCommander anterior a 4.2.6 y 5.x anterior a 5.0.3 utiliza permisos de escritura universal para (1) eccert.pl y (2) ecconfigure.pl, lo que permite a usuarios locales ejecutar código Perl arbitrario mediante la modificación de estos ficheros."
    }
  ],
  "lastModified": "2026-06-17T00:14:29.983",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:electric_cloud:electriccommander:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4076FB31-615F-43C6-9CC7-5E6B1C37F97C",
              "versionEndIncluding": "4.2.5"
            },
            {
              "criteria": "cpe:2.3:a:electric_cloud:electriccommander:5.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9CCF4B86-FD49-4337-9B25-8E17F810F390"
            },
            {
              "criteria": "cpe:2.3:a:electric_cloud:electriccommander:5.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AEB65D82-C014-4F01-825C-3BF7D1E313E9"
            },
            {
              "criteria": "cpe:2.3:a:electric_cloud:electriccommander:5.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DAD222FC-F8C1-4FD6-BD55-E1675429B1CD"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}