DSA-2024-331: Security Update for Dell ECS Host Header Injection Vulnerability
Résumé: Dell ECS remediation is available for a Host Header Injection vulnerability that could be exploited by malicious users to compromise the affected system.
Cet article concerne
Cet article ne concerne pas
Cet article n’est associé à aucun produit spécifique.
Toutes les versions du produit ne sont pas identifiées dans cet article.
Impact
Medium
Détails supplémentaires
Only Management API calls through a proxy or a load balancer are impacted. Data operations and Management API calls made directly to the ECS nodes are not impacted.
Détails
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-38485 | Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that leads to sensitive information leakage. | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-38485 | Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that leads to sensitive information leakage. | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Produits concernés et mesure corrective
| Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|
| ECS | Versions prior to 3.8.0 | Versions 3.8.0 or later | Click here to open an “Operating Environment Upgrade” Service Request |
| Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|
| ECS | Versions prior to 3.8.0 | Versions 3.8.0 or later | Click here to open an “Operating Environment Upgrade” Service Request |
Note:
- For more information on preventing Host Header Injection with Management API usage, please refer to the “Security fix for Management API” section in the ECS 3.8.1 Administration Guide.
- Only Management API calls through a proxy or a load balancer are impacted.
- Data operations are not impacted.
- Management API calls made directly to the ECS nodes are not impacted.
- Please refer to KB Article: 000205031 for use cases to implement the solution.
Historique des révisions
|
Revision |
Date |
Description |
|---|---|---|
|
1.0 |
2024-12-03 |
Initial Release |
Informations connexes
Mention légale
Produits concernés
ECS, ECS Appliance, ECS Appliance Software with Encryption, ECS Appliance Software without EncryptionPropriétés de l’article
Numéro d’article: 000256185
Type d’article: Dell Security Advisory
Dernière modification: 03 déc. 2024
Trouvez des réponses à vos questions auprès d’autres utilisateurs Dell
Services de support
Vérifiez si votre appareil est couvert par les services de support.