PT-2021-14569 · Dell Emc · Dell Powerprotect Cyber Recovery

Published 2021-02-19 · Updated 2021-02-25 · CVE-2021-21512

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Dell EMC PowerProtect Cyber Recovery version 19.7.0.1

Description The issue allows a locally authenticated high privileged Cyber Recovery user to potentially exploit it, leading to the takeover of the notification email account. This is due to an Information Disclosure vulnerability.

Recommendations For Dell EMC PowerProtect Cyber Recovery version 19.7.0.1, update to a version that contains a fix for this issue to prevent potential exploitation. As a temporary workaround, consider restricting access to the notification email account associated with Cyber Recovery until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-21512

Affected Products

Dell Powerprotect Cyber Recovery

References · 4

• https://dell.com/support/kbdoc/en-us/000183169/dsa-2021-038-dell-emc-powerprotect-cyber-recovery-security-update-for-unintended-information-disclosure · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21512 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21512 · Security Note
• https://t.me/cibsecurity/23874 · Telegram Post