DSA-2024-209: Security Update for Dell Update Manager Plugin Vulnerability
Riepilogo: Dell Update Manager Plugin remediation is available for plaintext password vulnerability in Log file that could be exploited by malicious users to compromise the affected system.
Questo articolo si applica a
Questo articolo non si applica a
Questo articolo non è legato a un prodotto specifico.
Non tutte le versioni del prodotto sono identificate in questo articolo.
Impatto
Low
Dettagli
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-28971 | Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account. | 3.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-28971 | Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account. | 3.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N |
Prodotti interessati e correzione
| Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|
| Dell Update Manager Plugin | Versions 1.4.0 through 1.5.0 | 1.5.1 | Dell OpenManage Enterprise Update Managerv1.5.1 | Driver Details | Dell US |
| Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|
| Dell Update Manager Plugin | Versions 1.4.0 through 1.5.0 | 1.5.1 | Dell OpenManage Enterprise Update Managerv1.5.1 | Driver Details | Dell US |
No action required from the customer if UMP-1.5.1 is already installed by the customer. However, we recommend following the workaround mentioned above.
Soluzioni alternative e mitigazioni
| CVE ID | Workaround and Mitigation |
|---|---|
| CVE-2024-28971 | Remove logs from UMP |
Cronologia delle revisioni
| Revision | Date | Description |
|---|---|---|
| 1.0 | 2024-05-07 | Initial release |
| 2.0 | 2025-04-15 | Added product tagging for better classification |
Informazioni correlate
Dichiarazione di non responsabilità
Prodotti interessati
OpenManage Enterprise Update ManagerProprietà dell'articolo
Numero articolo: 000224849
Tipo di articolo: Dell Security Advisory
Ultima modifica: 15 apr 2025
Trova risposta alle tue domande dagli altri utenti Dell
Support Services
Verifica che il dispositivo sia coperto dai Servizi di supporto.