PT-2024-5633 · Dell · Dell Storage Resource Manager

Published 2024-04-12 · Updated 2024-04-15 · CVE-2024-0157

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Dell Storage Resource Manager version 4.9.0.0 and below

Description The issue is related to a session fixation problem in the SRM Windows Host Agent. An unauthenticated attacker on an adjacent network could exploit this, potentially leading to the hijack of a targeted user's application session. The vulnerability may also be related to an uncontrolled resource consumption issue, which could allow a remote attacker to intercept an active user session.

Recommendations For Dell Storage Resource Manager version 4.9.0.0 and below, consider disabling the SRM Windows Host Agent as a temporary workaround until a patch is available. Restrict access to the agent to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Session Fixation

Weakness Enumeration

CWE-400

CWE-384

Related Identifiers

BDU:2024-06332

CVE-2024-0157

Affected Products

Dell Storage Resource Manager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-0157 · Security Note
• https://bdu.fstec.ru/vul/2024-06332 · Security Note
• https://dell.com/support/kbdoc/en-nz/000224070/dsa-2024-143-dell-storage-resource-manager-srm-and-dell-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-0157 · Vendor Advisory