PT-2024-28543 · Dell · Dell Appsync Server

B4Gpipe · Published 2024-10-09 · Updated 2024-10-17 · CVE-2024-39586

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dell AppSync Server versions 4.3 through 4.6

Description The issue is related to an XML External Entity Injection, which could be exploited by an adjacent high privileged attacker, potentially leading to information disclosure.

Recommendations For versions 4.3 through 4.6, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-39586

Affected Products

Dell Appsync Server

References · 7

• https://osv.dev/vulnerability/CVE-2024-39586 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000234216/dsa-2024-420-security-update-for-dell-emc-appsync-for-multiple-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39586 · Security Note
• https://twitter.com/VulmonFeeds/status/1843981406877155565 · Twitter Post
• https://twitter.com/CVEnew/status/1843913416530166186 · Twitter Post
• https://t.me/cvenotify/97569 · Telegram Post
• https://t.me/cvedetector/7437 · Telegram Post