PT-2018-13198 · Dell Emc · Idrac8+2

Published 2018-12-13 · Updated 2019-10-09 · CVE-2018-15774

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 Dell EMC iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23

Description The issue is related to a privilege escalation flaw in the Redfish interface, allowing an authenticated malicious user with operator privileges to potentially gain administrator access due to a permissions check flaw.

Recommendations For Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60, update to version 2.61.60.60 or later. For Dell EMC iDRAC9 versions prior to 3.20.21.20, update to version 3.20.21.20 or later. For Dell EMC iDRAC9 versions prior to 3.21.24.22, update to version 3.21.24.22 or later. For Dell EMC iDRAC9 versions prior to 3.21.26.22, update to version 3.21.26.22 or later. For Dell EMC iDRAC9 versions prior to 3.23.23.23, update to version 3.23.23.23 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2018-15774

Affected Products

Idrac7

Idrac8

Idrac9

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-15774 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15774 · Vendor Advisory
• https://dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en · Vendor Advisory
• http://securityfocus.com/bid/106233 · Note