PT-2023-1398 · Dell Emc · Ddos

Published 2023-02-01 · Updated 2023-02-08 · CVE-2023-23692

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dell EMC versions prior to DDOS 7.9

Description The issue is related to an OS command injection vulnerability. An authenticated non-admin attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. The vulnerability is associated with the failure to neutralize special elements used in the OS command.

Recommendations For versions prior to DDOS 7.9, update to version DDOS 7.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable application to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-00767

CVE-2023-23692

Affected Products

Ddos

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-23692 · Security Note
• https://dell.com/support/kbdoc/en-us/000201296/dsa-2022-187-dell-technologies-powerprotect-data-domain-security-update-for-multiple-third-party-component-vulnerabilities · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00767 · Security Note
• https://osv.dev/vulnerability/CVE-2023-23692 · Vendor Advisory
• https://t.me/cibsecurity/57297 · Telegram Post
• https://t.me/cvenotify/43919 · Telegram Post