CVE-2024-28977

Dell Repository Manager, versions 3.4.2 through 3.4.4,contains a Path Traversal vulnerability in logger module. A local attacker with low privileges could potentially exploit this vulnerability to gain unauthorized read access to the files stored on the server filesystem with the privileges of the running web application.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000224414/dsa-2024-190-security-update-for-dell-repository-manager-vulnerability	Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000224414/dsa-2024-190-security-update-for-dell-repository-manager-vulnerability	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dell:repository_manager:*:*:*:*:*:*:*:*

History

21 Jan 2025, 18:47

Type	Values Removed	Values Added
CPE		cpe:2.3:a:dell:repository_manager::::::::
CWE		CWE-22
First Time		Dell repository Manager Dell
References	~~() https://www.dell.com/support/kbdoc/en-us/000224414/dsa-2024-190-security-update-for-dell-repository-manager-vulnerability -~~	() https://www.dell.com/support/kbdoc/en-us/000224414/dsa-2024-190-security-update-for-dell-repository-manager-vulnerability - Vendor Advisory

Information

Published : 2024-04-24 08:15

Updated : 2025-01-21 18:47

NVD link : CVE-2024-28977

Mitre link : CVE-2024-28977

CVE.ORG link : CVE-2024-28977

JSON object : View

Products Affected

dell

repository_manager

CWE

CWE-20

Improper Input Validation

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2024-28977", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-04-24T08:15:37.897", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000224414/dsa-2024-190-security-update-for-dell-repository-manager-vulnerability", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}, {"url": "https://www.dell.com/support/kbdoc/en-us/000224414/dsa-2024-190-security-update-for-dell-repository-manager-vulnerability", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Dell Repository Manager, versions 3.4.2 through 3.4.4,contains a Path Traversal vulnerability in logger module. A local attacker with low privileges could potentially exploit this vulnerability to gain unauthorized read access to the files stored on the server filesystem with the privileges of the running web application."}, {"lang": "es", "value": "Dell Repository Manager, versiones 3.4.2 a 3.4.4, contiene una vulnerabilidad de path traversal en el m\u00f3dulo de registro. Un atacante local con privilegios bajos podr\u00eda explotar esta vulnerabilidad para obtener acceso de lectura no autorizado a los archivos almacenados en el sistema de archivos del servidor con los privilegios de la aplicaci\u00f3n web en ejecuci\u00f3n."}], "lastModified": "2025-01-21T18:47:57.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:repository_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0ADBA73E-5A64-4CC8-B8F5-4E425EEC2639", "versionEndIncluding": "3.4.4", "versionStartIncluding": "3.4.2"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}