CVE-2020-36695

Incorrect Default Permissions vulnerability in Hitachi Device Manager on Linux (Device Manager Server component), Hitachi Tiered Storage Manager on Linux, Hitachi Replication Manager on Linux, Hitachi Tuning Manager on Linux (Hitachi Tuning Manager server, Hitachi Tuning Manager - Agent for RAID, Hitachi Tuning Manager - Agent for NAS components), Hitachi Compute Systems Manager on Linux allows File Manipulation.This issue affects Hitachi Device Manager: before 8.8.5-02; Hitachi Tiered Storage Manager: before 8.8.5-02; Hitachi Replication Manager: before 8.8.5-02; Hitachi Tuning Manager: before 8.8.5-02; Hitachi Compute Systems Manager: before 8.8.3-08.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-124/index.html	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

OR	cpe:2.3:a:hitachi:compute_systems_manager::::::::
	cpe:2.3:a:hitachi:device_manager::::::::
	cpe:2.3:a:hitachi:replication_manager::::::::
	cpe:2.3:a:hitachi:tiered_storage_manager::::::::
	cpe:2.3:a:hitachi:tuning_manager::::::::

History

No history.

Information

Published : 2023-07-18 03:15

Updated : 2023-07-27 17:30

NVD link : CVE-2020-36695

Mitre link : CVE-2020-36695

CVE.ORG link : CVE-2020-36695

JSON object : View

Products Affected

hitachi

tiered_storage_manager
device_manager
tuning_manager
replication_manager
compute_systems_manager

linux

linux_kernel

CWE

CWE-276

Incorrect Default Permissions

{"id": "CVE-2020-36695", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "hirt@hitachi.co.jp", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 1.8}]}, "published": "2023-07-18T03:15:52.963", "references": [{"url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-124/index.html", "tags": ["Vendor Advisory"], "source": "hirt@hitachi.co.jp"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-276"}]}, {"type": "Secondary", "source": "hirt@hitachi.co.jp", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "Incorrect Default Permissions vulnerability in Hitachi Device Manager on Linux (Device Manager Server component), Hitachi Tiered Storage Manager on Linux, Hitachi Replication Manager on Linux, Hitachi Tuning Manager on Linux (Hitachi Tuning Manager server, Hitachi Tuning Manager - Agent for RAID, Hitachi Tuning Manager - Agent for NAS \n\ncomponents), Hitachi Compute Systems Manager on Linux allows File Manipulation.This issue affects Hitachi Device Manager: before 8.8.5-02; Hitachi Tiered Storage Manager: before 8.8.5-02; Hitachi Replication Manager: before 8.8.5-02; Hitachi Tuning Manager: before 8.8.5-02; Hitachi Compute Systems Manager: before 8.8.3-08.\n\n"}], "lastModified": "2023-07-27T17:30:56.823", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hitachi:compute_systems_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EAE91C8E-F0D3-4247-891C-742547E41147", "versionEndExcluding": "8.8.3-08"}, {"criteria": "cpe:2.3:a:hitachi:device_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7BAEB11-0356-426A-BAB8-1ED82F9FCF70", "versionEndExcluding": "8.8.5-02"}, {"criteria": "cpe:2.3:a:hitachi:replication_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C12A2776-0CB0-4A79-9437-11C3391F9E29", "versionEndExcluding": "8.8.5-02"}, {"criteria": "cpe:2.3:a:hitachi:tiered_storage_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7300DC33-D62A-4E97-83FF-786F5D6483FA", "versionEndExcluding": "8.8.5-02"}, {"criteria": "cpe:2.3:a:hitachi:tuning_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D59C88B4-8761-470C-BEA3-9AF6D2380455", "versionEndExcluding": "8.8.5-02"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "hirt@hitachi.co.jp"}