PT-2023-19137 · Dell · Vxrail

CVE-2023-23694 · Publicado 2023-05-23 · Atualizado 2023-06-05

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell VxRail versions earlier than 7.0.450

Description The issue is an OS command injection vulnerability in VxRail Manager. A local authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker.

Recommendations For versions earlier than 7.0.450, update to version 7.0.450 or later to resolve the issue. As a temporary workaround, consider restricting access to VxRail Manager to minimize the risk of exploitation.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2023-23694

Produtos afetados

Vxrail

Referências · 4

• https://dell.com/support/kbdoc/en-us/000213011/dsa-2023-071-dell-vxrail-security-update-for-multiple-third-party-component-vulnerabilities-7-0-450 · Aviso do Fabricante
• https://t.me/cvenotify/50970 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-23694 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-23694 · Nota de Segurança