« Volver al listado

CVE-2018-16497

Estado: AnalizadaAlta (7.8)—

In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server. If the job is run as the user root, there is a potential privilege escalation vulnerability. In this case, the job runs a script as root that is writable by users who are members of the versa group.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Versa-networks — Versa Analytics

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-16497",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Versa Analytics",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed Versions: 16.1R2S11, 20.2.2, 21.1.1, 21.2.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-05-26T19:15:08.643",
  "references": [
    {
      "url": "https://hackerone.com/reports/1168194",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://hackerone.com/reports/1168194",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server. If the job is run as the user root, there is a potential privilege escalation vulnerability. In this case, the job runs a script as root that is writable by users who are members of the versa group."
    },
    {
      "lang": "es",
      "value": "En Versa Analytics, los trabajos cron son utilizados para programar tareas ejecutando comandos en fechas y horas específicas en el servidor. Si el trabajo se ejecuta como usuario root, se presenta una potencial vulnerabilidad de escalada de privilegios. En este caso, el trabajo ejecuta un script como root que es escribible por usuarios que son miembros del grupo versa"
    }
  ],
  "lastModified": "2026-08-31T17:54:28.843",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:versa-networks:versa_analytics:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C513888B-043D-4076-A854-CFBFE055BBFC",
              "versionEndExcluding": "16.1R2S11"
            },
            {
              "criteria": "cpe:2.3:a:versa-networks:versa_analytics:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5FB6686-4023-491A-B0CE-2C0CA8D85B1C",
              "versionEndExcluding": "20.2.2",
              "versionStartIncluding": "20.2.0"
            },
            {
              "criteria": "cpe:2.3:a:versa-networks:versa_analytics:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A81F8F1-07EA-4F14-B6BB-2C6708CDC6BD",
              "versionEndExcluding": "21.1.1",
              "versionStartIncluding": "21.1.0"
            },
            {
              "criteria": "cpe:2.3:a:versa-networks:versa_analytics:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45AF1F8F-6B2A-4E07-8A74-D2D7950581D7",
              "versionEndExcluding": "21.2.1",
              "versionStartIncluding": "21.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}