Vitajte
Vitajte v spoločnosti Dell!
Moje konto
- Zadávajte objednávky rýchlo a jednoducho
- Pozrite si svoje objednávky a sledujte priebeh doručenia
- Vytvorte si zoznam svojich produktov a majte ho vždy poruke
- Spravujte svoje lokality Dell EMC, produkty a kontaktné informácie na úrovni produktov pomocou Správy informácií o spoločnosti.
Číslo článku: 000222470
DSA-2024-078: Security Update for Dell ECS access control Vulnerability.
Zhrnutie: Dell ECS remediation is available for access control vulnerability that could be exploited by malicious users to compromise the affected system.
Obsah článku
Dosah
Medium
Podrobnosti
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-22459 | Dell ECS, versions 3.6 through 3.6.2.5, and 3.7 through 3.7.0.6, and 3.8 through 3.8.0.4 versions, contain an improper access control vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to unauthorized access to all buckets and their data within a namespace. | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-22459 | Dell ECS, versions 3.6 through 3.6.2.5, and 3.7 through 3.7.0.6, and 3.8 through 3.8.0.4 versions, contain an improper access control vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to unauthorized access to all buckets and their data within a namespace. | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
Dotknuté produkty a riešenie problému
| CVEs Addressed | Product | Affected Version(s) | Remediated Versions | Link to Update |
|---|---|---|---|---|
| CVE-2024-22459 | Dell ECS | Versions 3.8 through 3.8.0.4 | ECS 3.8.0.5 |
https://www.dell.com/support/incidents-online |
| CVE-2024-22459 | Dell ECS | Version 3.7 through 3.7.0.6 | ECS 3.7.0.7 |
https://www.dell.com/support/incidents-online |
| CVE-2024-22459 | Dell ECS | Versions 3.6 through 3.6.2.5 | ECS 3.6.2.6 | https://www.dell.com/support/incidents-online |
| CVEs Addressed | Product | Affected Version(s) | Remediated Versions | Link to Update |
|---|---|---|---|---|
| CVE-2024-22459 | Dell ECS | Versions 3.8 through 3.8.0.4 | ECS 3.8.0.5 |
https://www.dell.com/support/incidents-online |
| CVE-2024-22459 | Dell ECS | Version 3.7 through 3.7.0.6 | ECS 3.7.0.7 |
https://www.dell.com/support/incidents-online |
| CVE-2024-22459 | Dell ECS | Versions 3.6 through 3.6.2.5 | ECS 3.6.2.6 | https://www.dell.com/support/incidents-online |
Dell recommends all customers have their ECS systems upgraded at the earliest opportunity by opening a “Operating Environment Upgrade” Service Request.
Dočasné riešenia a zmiernenie rizík
None
Potvrdenia
Dell Technologies would like to thank Amund Tenstad for reporting this issue.
História revízií
| Revision | Date | Description |
| 1.0 | 2024-02-26 | Initial Release |
Súvisiace informácie
Právne informácie
Vlastnosti článku
Dotknutý produkt
ECS, ECS Appliance Software with Encryption, ECS Appliance Software without Encryption
Dátum posledného zverejnenia
26 feb 2024
Verzia
1
Typ článku
Dell Security Advisory