PT-2024-5170 · Dell · Dell Repository Manager

Redfr0G · Published 2024-04-23 · Updated 2025-01-21 · CVE-2024-28977

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Dell Repository Manager versions 3.4.2 through 3.4.4

Description: The issue is related to a Path Traversal vulnerability in the logger module of Dell Repository Manager. This vulnerability can be exploited by a local attacker with low privileges to gain unauthorized read access to files stored on the server filesystem, using the privileges of the running web application. The vulnerability exists due to insufficient input validation in the logger module, which can allow an attacker to access information without proper authorization.

Recommendations: For versions 3.4.2 through 3.4.4, consider disabling the logger module as a temporary workaround until a patch is available. Restrict access to sensitive files on the server filesystem to minimize the risk of exploitation.

Fix

Path traversal

RCE

Weakness Enumeration

CWE-22

CWE-20

Related Identifiers

BDU:2024-05721

CVE-2024-28977

Affected Products

Dell Repository Manager

References · 7

• https://dell.com/support/kbdoc/en-us/000224414/dsa-2024-190-security-update-for-dell-repository-manager-vulnerability · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05721 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28977 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28977 · Security Note
• https://t.me/cvenotify/77865 · Telegram Post
• https://vuldb.com/?id.261877 · Note
• https://tenable.com/cve/CVE-2024-28977 · Note