PT-2024-5198 · Dell+1 · Dell Data Lakehouse+1

Published 2024-07-18 · Updated 2024-07-19 · CVE-2024-38302

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Dell Data Lakehouse version 1.0.0.0

Description: The issue is related to a Missing Encryption of Sensitive Data vulnerability in the DDAE (Starburst) component. This could allow a low-privileged attacker with adjacent network access to potentially exploit the vulnerability, leading to information disclosure. The vulnerability is associated with a lack of encryption measures for data, which could enable a remote attacker to disclose protected information.

Recommendations: For Dell Data Lakehouse version 1.0.0.0, consider implementing encryption for sensitive data in the DDAE (Starburst) component to prevent information disclosure. As a temporary workaround, restrict access to sensitive data until a proper encryption mechanism is in place.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

BDU:2024-05755

CVE-2024-38302

Affected Products

Ddae

Dell Data Lakehouse

References · 8

• https://dell.com/support/kbdoc/en-us/000227053/dsa-2024-303-security-update-for-dell-data-lakehouse-system-software-for-multiple-security-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-38302 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38302 · Security Note
• https://bdu.fstec.ru/vul/2024-05755 · Security Note
• https://vuldb.com/ru/?id.271896 · Note
• https://t.me/cvenotify/86728 · Telegram Post
• https://cvefeed.io/vuln/detail/CVE-2024-38302 · Note
• https://t.me/cvedetector/1156 · Telegram Post