PT-2022-22165 · Dell · Dell Hybrid Client

Published 2022-10-11 · Updated 2022-10-13 · CVE-2022-34430

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Dell Hybrid Client versions prior to 1.8

Description The issue concerns a Zip Bomb Vulnerability in the UI of Dell Hybrid Client, which could be exploited by an attacker with guest privileges, potentially leading to modification of system files.

Recommendations For versions prior to 1.8, update to version 1.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the UI to minimize the risk of exploitation.

Fix

Path traversal

XML Entity Expansion

Weakness Enumeration

CWE-22

CWE-776

Related Identifiers

CVE-2022-34430

Affected Products

Dell Hybrid Client

References · 4

• https://dell.com/support/kbdoc/en-us/000203345/dsa-2022-260-dell-hybrid-client-security-update-for-multiple-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34430 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34430 · Vendor Advisory
• https://t.me/cibsecurity/51130 · Telegram Post