DSA-2024-209: Security Update for Dell Update Manager Plugin Vulnerability
概要: Dell Update Manager Plugin remediation is available for plaintext password vulnerability in Log file that could be exploited by malicious users to compromise the affected system.
この記事は次に適用されます：
この記事は次には適用されません：
この記事は、特定の製品に関連付けられていません。
すべての製品パージョンがこの記事に記載されているわけではありません。
影響
Low
詳細
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-28971 | Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account. | 3.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-28971 | Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account. | 3.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N |
影響を受ける製品と修復
| Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|
| Dell Update Manager Plugin | Versions 1.4.0 through 1.5.0 | 1.5.1 | Dell OpenManage Enterprise Update Managerv1.5.1 | Driver Details | Dell US |
| Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|
| Dell Update Manager Plugin | Versions 1.4.0 through 1.5.0 | 1.5.1 | Dell OpenManage Enterprise Update Managerv1.5.1 | Driver Details | Dell US |
No action required from the customer if UMP-1.5.1 is already installed by the customer. However, we recommend following the workaround mentioned above.
回避策と緩和策
| CVE ID | Workaround and Mitigation |
|---|---|
| CVE-2024-28971 | Remove logs from UMP |
変更履歴
| Revision | Date | Description |
|---|---|---|
| 1.0 | 2024-05-07 | Initial release |
| 2.0 | 2025-04-15 | Added product tagging for better classification |
関連情報
法的免責事項
対象製品
OpenManage Enterprise Update Manager文書のプロパティ
文書番号: 000224849
文書の種類: Dell Security Advisory
最終更新: 15 4月 2025
質問に対する他のDellユーザーからの回答を見つける
サポート サービス
お使いのデバイスがサポート サービスの対象かどうかを確認してください。