PT-2024-34697 · Dell · Dell Ecs

Published 2024-12-26 · Updated 2025-01-21 · CVE-2024-51540

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell ECS versions prior to 3.8.1.3

Description The issue is related to an arithmetic overflow vulnerability in the retention period handling of ECS. An authenticated user with bucket or object-level access and the necessary privileges could potentially exploit this vulnerability to bypass retention policies and delete objects.

Recommendations For versions prior to 3.8.1.3, update to version 3.8.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the retention period handling functionality to minimize the risk of exploitation. Additionally, review and monitor object deletion activities to detect potential misuse of this vulnerability.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2024-51540

Affected Products

Dell Ecs

References · 8

• https://osv.dev/vulnerability/CVE-2024-51540 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51540 · Security Note
• https://dell.com/support/kbdoc/en-us/000256642/dsa-2024-483-security-update-for-dell-ecs-multiple-vulnerabilities · Vendor Advisory
• https://twitter.com/CVEnew/status/1872315491433300337 · Twitter Post
• https://t.me/cvedetector/13684 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1872346838268821796 · Twitter Post
• https://t.me/latest_high_impact_cve/1711 · Telegram Post
• https://twitter.com/cracbot/status/1873972414788624839 · Twitter Post