CVE-2020-36605 - Vulnerability Details - OpenCVE

Incorrect Default Permissions vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Linux (Analyzer probe component), Hitachi Ops Center Viewpoint on Linux (Viewpoint RAID Agent component) allows local users to read and write specific files. This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.0-00; Hitachi Ops Center Viewpoint: from 10.8.0-00 before 10.9.0-00.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Hitachi	Infrastructure Analytics Advisor Ops Center Analyzer Ops Center Viewpoint
Linux	Linux Kernel
Microsoft	Windows

Configuration 1 [-]

AND

cpe:2.3:a:hitachi:infrastructure_analytics_advisor:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:linux:linux_kernel:-::::::x64:
	cpe:2.3:o:microsoft:windows:-::::::x64:

Configuration 2 [-]

AND

cpe:2.3:a:hitachi:ops_center_analyzer:*:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:x64:*

Configuration 3 [-]

AND

cpe:2.3:a:hitachi:ops_center_viewpoint:*:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:x64:*

No data.

References

Link	Providers
https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-134/index.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: Hitachi

Published: 2022-11-01T02:07:14.263Z

Updated: 2024-08-04T17:30:08.464Z

Reserved: 2022-09-27T06:24:04.221Z

Link: CVE-2020-36605

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-11-01T03:15:10.617

Modified: 2024-11-21T05:29:52.817

Link: CVE-2020-36605

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2020-36605", "assignerOrgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "state": "PUBLISHED", "assignerShortName": "Hitachi", "requesterUserId": "a50f3adc-d641-48d6-b994-5cdc62b36cd5", "dateReserved": "2022-09-27T06:24:04.221Z", "datePublished": "2022-11-01T02:07:14.263Z", "dateUpdated": "2024-08-04T17:30:08.464Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Analytics probe"], "platforms": ["Linux"], "product": "Hitachi Infrastructure Analytics Advisor", "vendor": "Hitachi", "versions": [{"lessThanOrEqual": "4.4.0-00", "status": "affected", "version": "2.0.0-00", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Analyzer probe"], "platforms": ["Linux"], "product": "Hitachi Ops Center Analyzer", "vendor": "Hitachi", "versions": [{"changes": [{"at": "10.9.0-00", "status": "unaffected"}], "lessThan": "10.9.0-00", "status": "affected", "version": "10.0.0-00", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Viewpoint RAID Agent"], "platforms": ["Linux"], "product": "Hitachi Ops Center Viewpoint", "vendor": "Hitachi", "versions": [{"changes": [{"at": "10.9.0-00", "status": "unaffected"}], "lessThan": "10.9.0-00", "status": "affected", "version": "10.8.0-00", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(252, 252, 252);\">Incorrect Default Permissions vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Linux (Analyzer probe component), Hitachi Ops Center Viewpoint on Linux (Viewpoint RAID Agent component) allows local users to read and write specific files.</span>\n\n<br><br>This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.0-00; Hitachi Ops Center Viewpoint: from 10.8.0-00 before 10.9.0-00.<br>"}], "value": "Incorrect Default Permissions vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Linux (Analyzer probe component), Hitachi Ops Center Viewpoint on Linux (Viewpoint RAID Agent component) allows local users to read and write specific files.\n\n\n\nThis issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.0-00; Hitachi Ops Center Viewpoint: from 10.8.0-00 before 10.9.0-00.\n"}], "impacts": [{"capecId": "CAPEC-165", "descriptions": [{"lang": "en", "value": "CAPEC-165 File Manipulation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "50d0f415-c707-4733-9afc-8f6c0e9b3f82", "shortName": "Hitachi", "dateUpdated": "2023-01-17T04:23:27.652Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-134/index.html"}], "source": {"advisory": "hitachi-sec-2022-134", "discovery": "UNKNOWN"}, "title": "File Permissions Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer, Hitachi Ops Center Viewpoint", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T17:30:08.464Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-134/index.html"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hitachi:infrastructure_analytics_advisor:*:*:*:*:*:*:*:*", "matchCriteriaId": "7BC509D6-6EB5-4050-B0A8-776B489C8AD9", "versionEndIncluding": "4.4.0-00", "versionStartIncluding": "2.0.0-00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:x64:*", "matchCriteriaId": "71BFBE5F-56EB-45C9-B558-FC4D7CEA345A", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:x64:*", "matchCriteriaId": "82132539-3C34-4B63-BE2A-F51077D8BC5A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hitachi:ops_center_analyzer:*:*:*:*:*:*:*:*", "matchCriteriaId": "2390B3E6-5F10-4F6A-B41C-159D2A0DCAFD", "versionEndExcluding": "10.9.0-00", "versionStartIncluding": "10.0.0-00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:x64:*", "matchCriteriaId": "71BFBE5F-56EB-45C9-B558-FC4D7CEA345A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hitachi:ops_center_viewpoint:*:*:*:*:*:*:*:*", "matchCriteriaId": "5DCD3014-C1E0-47E2-9014-3D90D8AD03C3", "versionEndExcluding": "10.9.0-00", "versionStartIncluding": "10.8.0-00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:x64:*", "matchCriteriaId": "71BFBE5F-56EB-45C9-B558-FC4D7CEA345A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Incorrect Default Permissions vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Linux (Analyzer probe component), Hitachi Ops Center Viewpoint on Linux (Viewpoint RAID Agent component) allows local users to read and write specific files.\n\n\n\nThis issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.0-00; Hitachi Ops Center Viewpoint: from 10.8.0-00 before 10.9.0-00.\n"}, {"lang": "es", "value": "Vulnerabilidad de permisos predeterminados incorrectos en Hitachi Infrastructure Analytics Advisor en Linux (Analytics probe component), Hitachi Ops Center Analyzer en Linux (Analyzer probe component), Hitachi Ops Center Viewpoint en Linux (Viewpoint RAID Agent component) permite a los usuarios locales leer y escribir archivos espec\u00edficos . Este problema afecta a Hitachi Infrastructure Analytics Advisor: desde 2.0.0-00 hasta 4.4.0-00; Hitachi Ops Center Analyzer: desde 10.0.0-00 antes de 10.9.0-00; Hitachi Ops Center Viewpoint: desde 10.8.0-00 antes de 10.9.0-00."}], "id": "CVE-2020-36605", "lastModified": "2024-11-21T05:29:52.817", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.7, "source": "hirt@hitachi.co.jp", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-11-01T03:15:10.617", "references": [{"source": "hirt@hitachi.co.jp", "tags": ["Vendor Advisory"], "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-134/index.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-134/index.html"}], "sourceIdentifier": "hirt@hitachi.co.jp", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "hirt@hitachi.co.jp", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-276"}], "source": "nvd@nist.gov", "type": "Primary"}]}