SecuriTricks - CVE-2024-37144

Description

Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to RCM 3.7.6.0 (for RCM 3.7.x train), Dell PowerFlex custom node using PowerFlex Manager versions prior to 4.6.1.0, Dell InsightIQ versions prior to 5.1.1, and Dell Data Lakehouse versions prior to 1.2.0.0 contain an Insecure Storage of Sensitive Information vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure. The attacker may be able to use information disclosed to gain unauthorized access to pods within the cluster.

Product(s) Impacted

Product	Versions
Dell PowerFlex appliance	prior to IC 46.381.00 prior to IC 46.376.00
Dell PowerFlex rack	prior to RCM 3.8.1.0 (for RCM 3.8.x train) prior to RCM 3.7.6.0 (for RCM 3.7.x train)
Dell PowerFlex custom node using PowerFlex Manager	prior to 4.6.1.0
Dell InsightIQ	prior to 5.1.1
Dell Data Lakehouse	prior to 1.2.0.0

Weaknesses

CWE-922

Insecure Storage of Sensitive Information

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

References

https://www.dell.com/support/kbdoc/en-us/000258342/dsa-2024-405-security-update-for-dell-products-for-multiple-vulnerabilities

CVSS Score

8.2 / 10

CVSS Data

Attack Vector: LOCAL
Attack Complexity: LOW
Privileges Required: HIGH
Scope: CHANGED
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: HIGH

View Vector String

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Date

Published: Dec. 10, 2024, 3:15 a.m.
Last Modified: Dec. 10, 2024, 3:15 a.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security_alert@emc.com

CVE-2024-37144