by Kastro
Paper/Archive/CVE-2023-39245

CVE-2023-39245

Dell ESI (Enterprise Storage Integrator) for SAP LAMA — DELL ESI (Enterprise Storage Integrator) for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component.

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 48.5.485 × 209.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

DELL ESI (Enterprise Storage Integrator) for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component. An remote unauthenticated attacker could potentially exploit this vulnerability by eavesdropping the network traffic to gain admin level credentials.

Affected

ProductAffectedFixed inSource
ESI (Enterprise Storage Integrator) for SAP LAMA< V10.0.0.0V10.0.0.0CNA
enterprise_storage_integrator_for_sap_lama< 10.0.0.010.0.0.0CISA-ADP

Scores by source

dell (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorydell.com/support/kbdoc/en-us/000216654/dsa-2023-299-security-update-for-dell-esi-enterprise-storage-integrator-for-sap-lama-multiple-security-vulnerabilities