PT-2019-15528 · Dell · Dell Command Configure

Published 2019-12-06 · Updated 2020-10-16 · CVE-2019-18575

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell Command Configure versions prior to 4.2.1

Description The issue allows a locally authenticated malicious user to exploit an uncontrolled search path vulnerability. This can be done by creating a symlink to a target file, enabling the attacker to overwrite or corrupt a specified file on the system.

Recommendations For versions prior to 4.2.1, update to version 4.2.1 or later to resolve the issue.

Fix

Link Following

Uncontrolled Search Path Element

Weakness Enumeration

CWE-59

CWE-427

Related Identifiers

CVE-2019-18575

Affected Products

Dell Command Configure

References · 3

• https://dell.com/support/article/SLN319715 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-18575 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18575 · Security Note