PT-2023-19137 · Dell · Vxrail

Published 2023-05-23 · Updated 2023-06-05 · CVE-2023-23694

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell VxRail versions earlier than 7.0.450

Description The issue is an OS command injection vulnerability in VxRail Manager. A local authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker.

Recommendations For versions earlier than 7.0.450, update to version 7.0.450 or later to resolve the issue. As a temporary workaround, consider restricting access to VxRail Manager to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-23694

Affected Products

Vxrail

References · 4

• https://dell.com/support/kbdoc/en-us/000213011/dsa-2023-071-dell-vxrail-security-update-for-multiple-third-party-component-vulnerabilities-7-0-450 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-23694 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23694 · Security Note
• https://t.me/cvenotify/50970 · Telegram Post