CVE-2017-14380

Severity: medium (CVSS 6.7 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-12-13 · updated 2026-06-17
Weakness: CWE-269

Description

In EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, 8.0.0.0 - 8.0.0.4, 7.2.1.0 - 7.2.1.5, 7.2.0.x, and 7.1.1.x, a malicious compliance admin (compadmin) account user could exploit a vulnerability in isi_get_itrace or isi_get_profile maintenance scripts to run any shell script as system root on a cluster in compliance mode. This could potentially lead to an elevation of privilege for the compadmin user and violate compliance mode.

Affected products

EMC Isilon OneFS EMC Isilon OneFS versions prior to 8.1.0.1, EMC Isilon OneFS versions prior to 8.0.1.2, EMC Isilon OneF: 7.1.1.0, 7.1.1.1, 7.1.1.2, 7.1.1.3, 7.1.1.4, 7.1.1.5 (+20)

References

Get alerted when CVE-2017-14380 or the next vulnerability affects your stack