PT-2024-2798 · Dell · Dell Powerprotect Data Manager

Published 2024-02-13 · Updated 2024-02-27 · CVE-2024-22445

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Manager versions 19.15 and prior

Description The issue is an OS command injection vulnerability that could allow a remote high privileged attacker to execute arbitrary OS commands on the application's underlying OS with the privileges of the vulnerable application. This may lead to a system takeover by an attacker. The vulnerability exists due to the failure to neutralize special elements used in the OS command.

Recommendations For Dell PowerProtect Data Manager versions 19.15 and prior, consider disabling any functionality that allows remote high privileged access until a patch is available. Restrict access to the underlying OS to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-02937

CVE-2024-22445

Affected Products

Dell Powerprotect Data Manager

References · 6

• https://dell.com/support/kbdoc/en-us/000222025/dsa-2024-061-dell-power-protect-data-manager-update-for-multiple-security-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22445 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22445 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02937 · Security Note
• https://t.me/cvenotify/72455 · Telegram Post
• https://twitter.com/CVEnew/status/1757311720953885141 · Twitter Post