PT-2024-19286 · Dell · Dell Unity

Published 2024-01-24 · Updated 2024-01-30 · CVE-2024-22229

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dell Unity versions prior to 5.4

Description The issue allows log messages to be spoofed by an authenticated attacker. This can be exploited to forge log entries, create false alarms, and inject malicious content into logs, compromising their integrity. An attacker could also prevent the product from logging information during malicious actions or implicate an arbitrary user for such activities.

Recommendations For versions prior to 5.4, update to version 5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to logging functionality to minimize the risk of exploitation. Additionally, monitor logs closely for any suspicious activity and implement measures to detect and prevent log tampering.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

CWE-117

Related Identifiers

CVE-2024-22229

Affected Products

Dell Unity

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-22229 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22229 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities · Vendor Advisory
• https://twitter.com/CVEnew/status/1750197367226130693 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1750243340463829084 · Twitter Post