PT-2018-13198 · Dell Emc · Idrac8+2

Publicado 2018-12-13 · Atualizado 2019-10-09 · CVE-2018-15774

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 Dell EMC iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23

Description The issue is related to a privilege escalation flaw in the Redfish interface, allowing an authenticated malicious user with operator privileges to potentially gain administrator access due to a permissions check flaw.

Recommendations For Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60, update to version 2.61.60.60 or later. For Dell EMC iDRAC9 versions prior to 3.20.21.20, update to version 3.20.21.20 or later. For Dell EMC iDRAC9 versions prior to 3.21.24.22, update to version 3.21.24.22 or later. For Dell EMC iDRAC9 versions prior to 3.21.26.22, update to version 3.21.26.22 or later. For Dell EMC iDRAC9 versions prior to 3.23.23.23, update to version 3.23.23.23 or later.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2018-15774

Produtos afetados

Idrac7

Idrac8

Idrac9

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-15774 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-15774 · Aviso do Fabricante
• https://dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en · Aviso do Fabricante
• http://securityfocus.com/bid/106233 · Nota