CVE-2018-11067

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 contain an open redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
Dell EMC	Avamar	7.2.0; 7.2.1; 7.3.0; 7.3.1; 7.4.0; 7.4.1; 7.5.0; 7.5.1; 18.1
Dell EMC	Integrated Data Protection Appliance	2.0; 2.1; 2.2

References

http://www.securityfocus.com/bid/105969Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1042153Third Party Advisory, VDB Entry
https://seclists.org/fulldisclosure/2018/Nov/49Mailing List, Third Party Advisory
https://www.vmware.com/security/advisories/VMSA-2018-0029.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/105969Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1042153Third Party Advisory, VDB Entry
https://seclists.org/fulldisclosure/2018/Nov/49Mailing List, Third Party Advisory
https://www.vmware.com/security/advisories/VMSA-2018-0029.htmlPatch, Third Party Advisory

Timeline

Published: Nov 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-110684.6RSA BSAFE SSL-J versions prior to 6.2.4 contain a Heap Inspection vulnerability that could allow an attacker with physical access to the sys CVE-2018-110695.9RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher CVE-2018-11075.3It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to hav CVE-2018-110705.9RSA BSAFE Crypto-J versions prior to 6.2.4 and RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during CVE-2018-110717.5Dell EMC Isilon OneFS versions 7.1.1.x, 7.2.1.x, 8.0.0.x, 8.0.1.x, 8.1.0.x and 8.1.x prior to 8.1.2 and Dell EMC IsilonSD Edge versions 8.0.CVE-2018-110727.8Dell Digital Delivery versions prior to 3.5.1 contain a DLL Injection Vulnerability. A local authenticated malicious user with advance knowl CVE-2018-110734.8RSA Authentication Manager versions prior to 8.3 P3 contain a stored cross-site scripting vulnerability in the Operations Console. A malicio CVE-2018-110746.1RSA Authentication Manager versions prior to 8.3 P3 are affected by a DOM-based cross-site scripting vulnerability which exists in its embed CVE-2018-110754.7RSA Authentication Manager versions prior to 8.3 P3 contain a reflected cross-site scripting vulnerability in a Security Console page. A rem CVE-2018-110766.5Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0 and 7.4.1 and Dell EMC Integrated Data Protection Appliance (IDPA) 2.0 are CVE-2018-110776.7'getlogs' utility in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1 and 18.1 and Dell EMC Integrated CVE-2018-110787.5Dell EMC VPlex GeoSynchrony, versions prior to 6.1, contains an Insecure File Permissions vulnerability. A remote authenticated malicious us