DSA-2024-331: Security Update for Dell ECS Host Header Injection Vulnerability
Summary: Dell ECS remediation is available for a Host Header Injection vulnerability that could be exploited by malicious users to compromise the affected system.
Bu makale şunlar için geçerlidir:
Bu makale şunlar için geçerli değildir:
Bu makale, belirli bir ürüne bağlı değildir.
Bu makalede tüm ürün sürümleri tanımlanmamıştır.
Impact
Medium
Ek Ayrıntılar
Only Management API calls through a proxy or a load balancer are impacted. Data operations and Management API calls made directly to the ECS nodes are not impacted.
Details
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-38485 | Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that leads to sensitive information leakage. | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-38485 | Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that leads to sensitive information leakage. | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Etkilenen Ürünler ve Düzeltme
| Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|
| ECS | Versions prior to 3.8.0 | Versions 3.8.0 or later | Click here to open an “Operating Environment Upgrade” Service Request |
| Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|
| ECS | Versions prior to 3.8.0 | Versions 3.8.0 or later | Click here to open an “Operating Environment Upgrade” Service Request |
Note:
- For more information on preventing Host Header Injection with Management API usage, please refer to the “Security fix for Management API” section in the ECS 3.8.1 Administration Guide.
- Only Management API calls through a proxy or a load balancer are impacted.
- Data operations are not impacted.
- Management API calls made directly to the ECS nodes are not impacted.
- Please refer to KB Article: 000205031 for use cases to implement the solution.
Revision History
|
Revision |
Date |
Description |
|---|---|---|
|
1.0 |
2024-12-03 |
Initial Release |
Related Information
Yasal Uyarı
Etkilenen Ürünler
ECS, ECS Appliance, ECS Appliance Software with Encryption, ECS Appliance Software without EncryptionMakale Özellikleri
Article Number: 000256185
Article Type: Dell Security Advisory
Son Değiştirme: 03 Ara 2024
Sorularınıza diğer Dell kullanıcılarından yanıtlar bulun
Destek Hizmetleri
Aygıtınızın Destek Hizmetleri kapsamında olup olmadığını kontrol edin.