PT-2024-22780 · Dell · Dell Data Domain

Published 2024-06-26 · Updated 2024-09-23 · CVE-2024-29174

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dell Data Domain versions prior to 7.13.0.0 Dell Data Domain LTS 7.7.5.30 Dell Data Domain LTS 7.10.1.20

Description The issue allows a local low privileged attacker to potentially exploit an SQL Injection vulnerability, leading to the execution of certain SQL commands on the application's backend database, causing unauthorized access to application data.

Recommendations For versions prior to 7.13.0.0, update to version 7.13.0.0 or later. For LTS 7.7.5.30, update to a version later than 7.7.5.30. For LTS 7.10.1.20, update to a version later than 7.10.1.20. As a temporary workaround, consider restricting access to the backend database to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-29174

Affected Products

Dell Data Domain

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-29174 · Security Note
• https://dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-29174 · Vendor Advisory
• https://t.me/cvenotify/95745 · Telegram Post
• https://t.me/cvenotify/84439 · Telegram Post