PT-2024-19439 · Dell Emc · Dell Emc Appsync

Published 2024-02-08 · Updated 2024-03-02 · CVE-2024-22464

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dell EMC AppSync versions 4.2.0.0 through 4.6.0.0

Description The issue allows a high privileged remote attacker to potentially exploit an exposure of sensitive information vulnerability in AppSync server logs, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable system with privileges of the compromised account.

Recommendations For Dell EMC AppSync versions 4.2.0.0 through 4.6.0.0, consider restricting access to the AppSync server logs to minimize the risk of exploitation. As a temporary workaround, limit the privileges of accounts that could be compromised by the exposed credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-22464

Affected Products

Dell Emc Appsync

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-22464 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22464 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000221932/dsa-2024-072-security-update-for-dell-emc-appsync-for-vulnerabilities · Vendor Advisory
• https://twitter.com/Esparta6108713/status/1763855308303352285 · Twitter Post
• https://twitter.com/RedPacketSec/status/1755895724397522945 · Twitter Post