PT-2024-2581 · Dell · Dell Powerprotect Data Manager

Published 2024-02-13 · Updated 2025-01-27 · CVE-2024-25971

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:M/C:C/I:N/A:P

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Manager version 19.15

Description The issue is related to an XML External Entity Injection vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to information disclosure, denial-of-service. The vulnerability is associated with incorrect restriction of XML links to external objects, which could allow an attacker to gain unauthorized access to confidential data or cause a denial of service.

Recommendations For Dell PowerProtect Data Manager version 19.15, consider disabling the XML external entity injection functionality until a patch is available. Restrict access to sensitive data and configure the system to limit the impact of a potential denial-of-service attack. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2024-02640

CVE-2024-25971

Affected Products

Dell Powerprotect Data Manager

References · 8

• https://dell.com/support/kbdoc/en-us/000223556/dsa-2024-132-security-update-dell-power-protect-data-manager-for-multiple-security-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25971 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25971 · Security Note
• https://bdu.fstec.ru/vul/2024-02640 · Security Note
• https://t.me/cvenotify/108723 · Telegram Post
• https://twitter.com/RedPacketSec/status/1775086928615944672 · Twitter Post
• https://twitter.com/CVEnew/status/1773461367535898857 · Twitter Post
• https://t.me/cvenotify/75023 · Telegram Post