CVE-2024-37142

Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and escalation of privilege

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000225474/dsa-2024-242	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dell:peripheral_manager:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-07-31 09:15

Updated : 2024-08-08 21:17

NVD link : CVE-2024-37142

Mitre link : CVE-2024-37142

CVE.ORG link : CVE-2024-37142

JSON object : View

Products Affected

dell

peripheral_manager

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2024-37142", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2024-07-31T09:15:04.700", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000225474/dsa-2024-242", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and escalation of privilege"}, {"lang": "es", "value": "Dell Peripheral Manager, versiones anteriores a 1.7.6, contiene una vulnerabilidad de elemento de ruta de b\u00fasqueda no controlada. Un atacante podr\u00eda explotar esta vulnerabilidad mediante la precarga de una DLL maliciosa o la explotaci\u00f3n de enlaces simb\u00f3licos, lo que lleva a la ejecuci\u00f3n de c\u00f3digo arbitrario y la escalada de privilegios."}], "lastModified": "2024-08-08T21:17:18.647", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:peripheral_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "99B6BBE4-2845-44DA-BC9D-C80FB9537457", "versionEndExcluding": "1.7.6"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}