PT-2021-21233 · Dell Emc · Dell Emc Streaming Data Platform

Published 2021-11-30 · Updated 2021-12-02 · CVE-2021-36330

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC Streaming Data Platform versions prior to 1.3

Description The issue allows a remote unauthenticated attacker to potentially reuse old session artifacts and impersonate a legitimate user due to insufficient session expiration.

Recommendations For versions prior to 1.3, update to version 1.3 or later to resolve the issue. As a temporary workaround, consider implementing additional session validation mechanisms to minimize the risk of exploitation. Restrict access to sensitive areas of the platform to minimize the risk of unauthorized access until the issue is resolved.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2021-36330

Affected Products

Dell Emc Streaming Data Platform

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-36330 · Security Note
• https://dell.com/support/kbdoc/en-in/000193697/dsa-2021-205-dell-emc-streaming-data-platform-security-update-for-third-party-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36330 · Vendor Advisory
• https://t.me/cvenotify/24088 · Telegram Post
• https://t.me/cibsecurity/33148 · Telegram Post