by Kastro
Paper/Archive/CVE-2024-37131

CVE-2024-37131

Dell Secure Connect Gateway (SCG) Policy Manager — SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability.

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 42.1.421 × 208.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious actions on the application in the context of the authenticated user.

Affected

ProductAffectedFixed inSource
Secure Connect Gateway (SCG) Policy Manager5.18.20 – 5.22.00.18–CNA
secure_connect_gateway_policy_manager5.18.20 – 5.22.00.18–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
dell (CNA)7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorydell.com/support/kbdoc/en-us/000225956/dsa-2024-254-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities