PT-2024-11970 · Dell · Dell Repository Manager

Marius Gabriel Mihai · Published 2024-08-21 · Updated 2024-08-25 · CVE-2023-22576

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell Repository Manager versions 3.4.2 and earlier

Description A local low privileged attacker may potentially exploit a Local Privilege Escalation Vulnerability in the Installation module, leading to the execution of arbitrary executables on the operating system with high privileges. This exploitation may result in the unavailability of the service.

Recommendations For Dell Repository Manager versions 3.4.2 and earlier, patch immediately to prevent privilege escalation and unauthorized access. As a temporary workaround, consider restricting access to the Installation module until a patch is available.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2023-22576

Affected Products

Dell Repository Manager

References · 11

• https://dell.com/support/kbdoc/en-us/000207513/dsa-2023-017-dell-emc-repository-manager-drm-security-update-for-an-improper-privilege-management-vulnerability · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22576 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22576 · Vendor Advisory
• https://twitter.com/cracbot/status/1827949154540409061 · Twitter Post
• https://twitter.com/oktsec/status/1826216250181087513 · Twitter Post
• https://twitter.com/CVEnew/status/1826206103564378276 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1826234733006618723 · Twitter Post
• https://twitter.com/Infosec_techs/status/1826856843102052724 · Twitter Post
• https://t.me/cvenotify/91972 · Telegram Post
• https://t.me/cvedetector/3765 · Telegram Post
• https://t.me/cvenotify/91472 · Telegram Post