PT-2024-3261 · Dell · Dell Powerprotect Data Manager

Published 2024-02-13 · Updated 2024-02-27 · CVE-2024-22454

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Manager versions 19.15 and prior

Description The issue is related to a weak password recovery mechanism for forgotten passwords in Dell PowerProtect Data Manager. A remote unauthenticated attacker could potentially exploit this, leading to unauthorized access to the application with privileges of the compromised account. The attacker could retrieve the reset password token without authorization and then perform the password change.

Recommendations For versions 19.15 and prior, consider disabling the password recovery feature until a patch is available to prevent exploitation. Restrict access to the password reset functionality to minimize the risk of unauthorized access. Avoid using the password recovery mechanism until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-640

Related Identifiers

BDU:2024-03492

CVE-2024-22454

Affected Products

Dell Powerprotect Data Manager

References · 8

• https://dell.com/support/kbdoc/en-us/000222025/dsa-2024-061-dell-power-protect-data-manager-update-for-multiple-security-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22454 · Security Note
• https://bdu.fstec.ru/vul/2024-03492 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22454 · Vendor Advisory
• https://twitter.com/R00tedSec/status/1757336166011936952 · Twitter Post
• https://t.me/cvenotify/72462 · Telegram Post
• https://twitter.com/CVEnew/status/1757311721985789972 · Twitter Post
• https://twitter.com/RsSI47041968/status/1757475234859692524 · Twitter Post