DSA-2024-078: Security Update for Dell ECS access control Vulnerability.
Résumé: Dell ECS remediation is available for access control vulnerability that could be exploited by malicious users to compromise the affected system.
Cet article concerne
Cet article ne concerne pas
Cet article n’est associé à aucun produit spécifique.
Toutes les versions du produit ne sont pas identifiées dans cet article.
Impact
Medium
Détails
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-22459 | Dell ECS, versions 3.6 through 3.6.2.5, and 3.7 through 3.7.0.6, and 3.8 through 3.8.0.4 versions, contain an improper access control vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to unauthorized access to all buckets and their data within a namespace. | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-22459 | Dell ECS, versions 3.6 through 3.6.2.5, and 3.7 through 3.7.0.6, and 3.8 through 3.8.0.4 versions, contain an improper access control vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to unauthorized access to all buckets and their data within a namespace. | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
Produits concernés et mesure corrective
| CVEs Addressed | Product | Affected Version(s) | Remediated Versions | Link to Update |
|---|---|---|---|---|
| CVE-2024-22459 | Dell ECS | Versions 3.8 through 3.8.0.4 | ECS 3.8.0.5 |
https://www.dell.com/support/incidents-online |
| CVE-2024-22459 | Dell ECS | Version 3.7 through 3.7.0.6 | ECS 3.7.0.7 |
https://www.dell.com/support/incidents-online |
| CVE-2024-22459 | Dell ECS | Versions 3.6 through 3.6.2.5 | ECS 3.6.2.6 | https://www.dell.com/support/incidents-online |
| CVEs Addressed | Product | Affected Version(s) | Remediated Versions | Link to Update |
|---|---|---|---|---|
| CVE-2024-22459 | Dell ECS | Versions 3.8 through 3.8.0.4 | ECS 3.8.0.5 |
https://www.dell.com/support/incidents-online |
| CVE-2024-22459 | Dell ECS | Version 3.7 through 3.7.0.6 | ECS 3.7.0.7 |
https://www.dell.com/support/incidents-online |
| CVE-2024-22459 | Dell ECS | Versions 3.6 through 3.6.2.5 | ECS 3.6.2.6 | https://www.dell.com/support/incidents-online |
Dell recommends all customers have their ECS systems upgraded at the earliest opportunity by opening a “Operating Environment Upgrade” Service Request.
Solutions de contournement et mesures d’atténuation
None
Historique des révisions
| Revision | Date | Description |
| 1.0 | 2024-02-26 | Initial Release |
Remerciements
Dell Technologies would like to thank Amund Tenstad for reporting this issue.
Informations connexes
Mention légale
Produits concernés
ECS, ECS Appliance Software with Encryption, ECS Appliance Software without EncryptionPropriétés de l’article
Numéro d’article: 000222470
Type d’article: Dell Security Advisory
Dernière modification: 26 Feb 2024
Trouvez des réponses à vos questions auprès d’autres utilisateurs Dell
Services de support
Vérifiez si votre appareil est couvert par les services de support.