Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Enjoy members-only rewards and discounts
  • Create and access a list of your products
Sign In Create an Account Premier Sign In Partner Program Sign In
Contact Us

Your Dell.com Baskets

DSA-2024-331: Security Update for Dell ECS Host Header Injection Vulnerability

Summary: Dell ECS remediation is available for a Host Header Injection vulnerability that could be exploited by malicious users to compromise the affected system.

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Impact

Medium

Additional Details

Only Management API calls through a proxy or a load balancer are impacted. Data operations and Management API calls made directly to the ECS nodes are not impacted.

Details

Proprietary Code CVEs Description CVSS Base Score CVSS Vector String
CVE-2024-38485 Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that leads to sensitive information leakage. 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NThis hyperlink is taking you to a website outside of Dell Technologies.
Proprietary Code CVEs Description CVSS Base Score CVSS Vector String
CVE-2024-38485 Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that leads to sensitive information leakage. 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NThis hyperlink is taking you to a website outside of Dell Technologies.
Dell Technologies recommends all customers consider both the CVSS base score and any relevant temporal and environmental scores that may impact the potential severity associated with a particular security vulnerability.

Affected Products & Remediation

Product Affected Versions Remediated Versions Link
ECS Versions prior to 3.8.0 Versions 3.8.0 or later Click here to open an “Operating Environment Upgrade” Service Request
Product Affected Versions Remediated Versions Link
ECS Versions prior to 3.8.0 Versions 3.8.0 or later Click here to open an “Operating Environment Upgrade” Service Request
Note:
  • For more information on preventing Host Header Injection with Management API usage, please refer to the “Security fix for Management API” section in the ECS 3.8.1 Administration Guide.
  • Only Management API calls through a proxy or a load balancer are impacted.
    • Data operations are not impacted.
    • Management API calls made directly to the ECS nodes are not impacted.
  • Please refer to KB Article: 000205031 for use cases to implement the solution.

Revision History

Revision

Date

Description

1.0

2024-12-03

Initial Release

Related Information

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

Legal Disclaimer

Affected Products

ECS, ECS Appliance, ECS Appliance Software with Encryption, ECS Appliance Software without Encryption
Article Properties
Article Number: 000256185
Article Type: Dell Security Advisory
Last Modified: 03 Dec 2024
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.