by Kastro
Paper/Archive/CVE-2024-22433

CVE-2024-22433

Dell Data Protection Search — Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.get_ldap_info…

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.8.508 × 2010.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.get_ldap_info in DP Search. A remote unauthorized unauthenticated attacker could potentially exploit this vulnerability leading to a loss of Confidentiality, Integrity, Protection, and remote takeover of the system. This is a high-severity vulnerability as it allows an attacker to take complete control of DP Search to affect downstream protected devices.

Affected

ProductAffectedFixed inSource
Data Protection Search19.2.0–CNA
Data Protection Search19.3.0–CNA
Data Protection Search19.4.0–CNA
Data Protection Search19.5.0–CNA
Data Protection Search19.5.1–CNA
Data Protection Search19.6.0–CNA
Data Protection Search19.6.1–CNA
Data Protection Search19.6.2–CNA
Data Protection Search19.6.3–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
dell (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisorydell.com/support/kbdoc/en-us/000221720/dsa-2024-063-security-update-for-dell-data-protection-search-multiple-security-vulnerabilities