PT-2019-16701 · Dell Emc · Idrac8+2

Published 2019-11-07 · Updated 2020-10-16 · CVE-2019-3764

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Dell EMC iDRAC7 versions prior to 2.65.65.65 Dell EMC iDRAC8 versions prior to 2.70.70.70 Dell EMC iDRAC9 versions prior to 3.36.36.36

Description The issue concerns an improper authorization vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this to obtain sensitive information, such as password hashes.

Recommendations For Dell EMC iDRAC7 versions prior to 2.65.65.65, update to version 2.65.65.65 or later. For Dell EMC iDRAC8 versions prior to 2.70.70.70, update to version 2.70.70.70 or later. For Dell EMC iDRAC9 versions prior to 3.36.36.36, update to version 3.36.36.36 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2019-3764

Affected Products

Idrac7

Idrac8

Idrac9

References · 3

• https://osv.dev/vulnerability/CVE-2019-3764 · Vendor Advisory
• https://dell.com/support/article/sln319317/dsa-2019-137-idrac-improper-authorization-vulnerability?lang=en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3764 · Security Note