CVE-2018-15772

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Dell EMC RecoverPoint versions prior to 5.1.2.1 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an uncontrolled resource consumption vulnerability. A malicious boxmgmt user may potentially be able to consume large amount of CPU bandwidth to make the system slow or to determine the existence of any system file via Boxmgmt CLI.

Metrics

CVSS 3.0 7.1/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
Dell EMC	Dell EMC RecoverPoint	>= unspecified, < 5.1.2.1
Dell EMC	Dell EMC RecoverPoint Virtual Machine (VM)	>= unspecified, < 5.2.0.2

References

http://www.securityfocus.com/bid/105916Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1042059Third Party Advisory, VDB Entry
https://seclists.org/fulldisclosure/2018/Nov/34Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/105916Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1042059Third Party Advisory, VDB Entry
https://seclists.org/fulldisclosure/2018/Nov/34Mailing List, Third Party Advisory

Timeline

Published: Nov 13, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-157734.3Dell Encryption (formerly Dell Data Protection | Encryption) v10.1.0 and earlier contain an information disclosure vulnerability. A maliciou CVE-2018-157748.8Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 contain CVE-2018-157766.8Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physi CVE-2018-157787.8Dell OS10 versions prior to 10.4.2.1 contain a vulnerability caused by lack of proper input validation on the command-line interface (CLI).CVE-2018-157806.5RSA Archer versions prior to 6.5.0.1 contain an improper access control vulnerability. A remote malicious user could potentially exploit thi CVE-2018-157818.0The Dell Wyse Password Encoder in ThinLinux2 versions prior to 2.1.0.01 contain a Hard-coded Cryptographic Key vulnerability. An unauthentic CVE-2018-157827.8The Quick Setup component of RSA Authentication Manager versions prior to 8.4 is vulnerable to a relative path traversal vulnerability. A lo CVE-2018-157847.4Dell Networking OS10 versions prior to 10.4.3.0 contain a vulnerability in the Phone Home feature which does not properly validate the serve CVE-2018-157958.1Pivotal CredHub Service Broker, versions prior to 1.1.0, uses a guessable form of random number generation in creating service broker's UAA CVE-2018-157968.1Cloud Foundry Bits Service Release, versions prior to 2.14.0, uses an insecure hashing algorithm to sign URLs. A remote malicious user may o CVE-2018-157978.8Cloud Foundry NFS volume release, 1.2.x prior to 1.2.5, 1.5.x prior to 1.5.4, 1.7.x prior to 1.7.3, logs the cf admin username and password CVE-2018-157985.4Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker