PT-2022-6280 · Dell · Dell Geodrive

Published 2022-09-22 · Updated 2022-10-14 · CVE-2022-33919

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell GeoDrive versions 2.1 through 2.2

Description The issue is related to the lack of protection for service data in the graphical interface of the local file system. This could allow an attacker to disclose protected information. An authenticated non-admin user could potentially exploit this and view sensitive information.

Recommendations For Dell GeoDrive versions 2.1 through 2.2, consider restricting access to sensitive information until a fix is available. As a temporary workaround, limit the privileges of non-admin users to minimize the risk of exploitation.

Fix

Improper Access Control

Incorrect Privilege Assignment

Information Disclosure

Weakness Enumeration

CWE-284

CWE-266

CWE-200

Related Identifiers

BDU:2023-00730

CVE-2022-33919

Affected Products

Dell Geodrive

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-33919 · Security Note
• https://bdu.fstec.ru/vul/2023-00730 · Security Note
• https://dell.com/support/kbdoc/000203632 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-33919 · Vendor Advisory