DSA-2024-331: Security Update for Dell ECS Host Header Injection Vulnerability
Resumo: Dell ECS remediation is available for a Host Header Injection vulnerability that could be exploited by malicious users to compromise the affected system.
Este artigo aplica-se a
Este artigo não se aplica a
Este artigo não está vinculado a nenhum produto específico.
Nem todas as versões do produto estão identificadas neste artigo.
Impacto
Medium
Detalhes adicionais
Only Management API calls through a proxy or a load balancer are impacted. Data operations and Management API calls made directly to the ECS nodes are not impacted.
Dados
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-38485 | Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that leads to sensitive information leakage. | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-38485 | Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that leads to sensitive information leakage. | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Produtos afetados e soluções
| Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|
| ECS | Versions prior to 3.8.0 | Versions 3.8.0 or later | Click here to open an “Operating Environment Upgrade” Service Request |
| Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|
| ECS | Versions prior to 3.8.0 | Versions 3.8.0 or later | Click here to open an “Operating Environment Upgrade” Service Request |
Note:
- For more information on preventing Host Header Injection with Management API usage, please refer to the “Security fix for Management API” section in the ECS 3.8.1 Administration Guide.
- Only Management API calls through a proxy or a load balancer are impacted.
- Data operations are not impacted.
- Management API calls made directly to the ECS nodes are not impacted.
- Please refer to KB Article: 000205031 for use cases to implement the solution.
Histórico de revisão
|
Revision |
Date |
Description |
|---|---|---|
|
1.0 |
2024-12-03 |
Initial Release |
Informações relacionadas
Aviso de isenção legal
Produtos afetados
ECS, ECS Appliance, ECS Appliance Software with Encryption, ECS Appliance Software without EncryptionPropriedades do artigo
Número do artigo: 000256185
Tipo de artigo: Dell Security Advisory
Último modificado: 03 dez. 2024
Encontre as respostas de outros usuários da Dell para suas perguntas.
Serviços de suporte
Verifique se o dispositivo está coberto pelos serviços de suporte.