DSA-2024-331: Security Update for Dell ECS Host Header Injection Vulnerability
Summary: Dell ECS remediation is available for a Host Header Injection vulnerability that could be exploited by malicious users to compromise the affected system.
Ez a cikk a következő(k)re vonatkozik:
Ez a cikk nem vonatkozik a következő(k)re:
Ez a cikk nem kapcsolódik egyetlen konkrét termékhez sem.
Ez a cikk nem azonosítja az összes termékverziót.
Impact
Medium
További részletek
Only Management API calls through a proxy or a load balancer are impacted. Data operations and Management API calls made directly to the ECS nodes are not impacted.
Details
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-38485 | Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that leads to sensitive information leakage. | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-38485 | Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that leads to sensitive information leakage. | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Érintett termékek és helyreállítás
| Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|
| ECS | Versions prior to 3.8.0 | Versions 3.8.0 or later | Click here to open an “Operating Environment Upgrade” Service Request |
| Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|
| ECS | Versions prior to 3.8.0 | Versions 3.8.0 or later | Click here to open an “Operating Environment Upgrade” Service Request |
Note:
- For more information on preventing Host Header Injection with Management API usage, please refer to the “Security fix for Management API” section in the ECS 3.8.1 Administration Guide.
- Only Management API calls through a proxy or a load balancer are impacted.
- Data operations are not impacted.
- Management API calls made directly to the ECS nodes are not impacted.
- Please refer to KB Article: 000205031 for use cases to implement the solution.
Revision History
|
Revision |
Date |
Description |
|---|---|---|
|
1.0 |
2024-12-03 |
Initial Release |
Related Information
Jogi nyilatkozat
Érintett termékek
ECS, ECS Appliance, ECS Appliance Software with Encryption, ECS Appliance Software without EncryptionTermék tulajdonságai
Article Number: 000256185
Article Type: Dell Security Advisory
Utoljára módosítva: 03 dec. 2024
Választ kaphat kérdéseire más Dell-felhasználóktól
Támogatási szolgáltatások
Ellenőrizze, hogy a készüléke rendelkezik-e támogatási szolgáltatással.