PT-2023-21510 · Dell · Dell Cloudiq Collector

Published 2023-05-19 · Updated 2023-05-26 · CVE-2023-28045

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dell CloudIQ Collector version 1.10.2

Description The issue is related to a missing encryption of sensitive data, which could be exploited by an attacker with low privileges to gain access to unauthorized data.

Recommendations For Dell CloudIQ Collector version 1.10.2, consider updating to a newer version that addresses the missing encryption of sensitive data issue, however, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2023-28045

Affected Products

Dell Cloudiq Collector

References · 5

• https://osv.dev/vulnerability/CVE-2023-28045 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28045 · Security Note
• https://dell.com/support/kbdoc/en-us/000213696/dsa-2023-165-dell-cloudiq-collector-security-update-for-missing-encryption-of-sensitive-data-vulnerability · Vendor Advisory
• https://t.me/cvenotify/50806 · Telegram Post
• https://t.me/cibsecurity/64450 · Telegram Post