7.8
CVE-2023-44285
- EPSS 0.22%
- Veröffentlicht 14.12.2023 16:15:47
- Zuletzt bearbeitet 21.11.2024 08:25:35
- Erkennungen
LoginDell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an improper access control vulnerability. A local malicious user with low privileges could potentially exploit this vulnerability leading to escalation of privilege.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dell ≫ Apex Protection Storage Version < 6.2.1.110
Dell ≫ Apex Protection Storage Version >= 7.0 < 7.10.1.15
Dell ≫ Powerprotect Data Domain SwEdition virtual Version < 6.2.1.110
Dell ≫ Powerprotect Data Domain SwEdition virtual Version >= 7.0 < 7.12.0.0
Dell ≫ Powerprotect Data Domain Management Center Version < 6.2.1.110
Dell ≫ Powerprotect Data Domain Management Center Version >= 7.0 < 7.13.0.10
Dell ≫ Emc Data Domain Os Version < 6.2.1.110
Dell ≫ Emc Data Domain Os Version >= 7.0 < 7.12.0.0
Dell ≫ Emc Data Domain Os SwEdition lts2022 Version >= 7.7 < 7.7.5.25
Dell ≫ Emc Data Domain Os SwEdition lts2023 Version >= 7.10 < 7.10.1.15
Dell ≫ Powerprotect Data Domain Management Center SwEdition lts2022 Version >= 7.7 < 7.7.5.25
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.22% | 0.124 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.8 | 1.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| EMC | 7.8 | 1.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
CWE-1220 Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
https://www.dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities