PT-2023-1398 · Dell Emc · Ddos

Publicado 2023-02-01 · Atualizado 2023-02-08 · CVE-2023-23692

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dell EMC versions prior to DDOS 7.9

Description The issue is related to an OS command injection vulnerability. An authenticated non-admin attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. The vulnerability is associated with the failure to neutralize special elements used in the OS command.

Recommendations For versions prior to DDOS 7.9, update to version DDOS 7.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable application to minimize the risk of exploitation.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2023-00767

CVE-2023-23692

Produtos afetados

Ddos

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-23692 · Nota de Segurança
• https://dell.com/support/kbdoc/en-us/000201296/dsa-2022-187-dell-technologies-powerprotect-data-domain-security-update-for-multiple-third-party-component-vulnerabilities · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-00767 · Nota de Segurança
• https://t.me/cibsecurity/57297 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-23692 · Aviso do Fabricante
• https://t.me/cvenotify/43919 · Publicação no Telegram