PT-2019-16688 · Dell Emc · Dell Emc Integrated Data Protection Appliance

Published 2019-09-27 · Updated 2019-10-09 · CVE-2019-3746

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC Integrated Data Protection Appliance versions prior to 2.3

Description The issue allows an authenticated remote user to launch a brute-force authentication attack against the ACM API, potentially gaining access to the system, due to the lack of limitation on the number of authentication attempts.

Recommendations For versions prior to 2.3, update to version 2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the ACM API to minimize the risk of exploitation.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2019-3746

Affected Products

Dell Emc Integrated Data Protection Appliance

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-3746 · Security Note
• https://dell.com/support/security/en-us/details/536363/DSA-2019-112-Dell-EMC-Integrated-Data-Protection-Appliance-Multiple-Vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3746 · Vendor Advisory