PT-2024-7368 · Dell · Dell Openmanage Enterprise

B4Gpipe · Published 2024-10-16 · Updated 2024-12-02 · CVE-2024-45767

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Dell OpenManage Enterprise versions OME 4.1 and prior

Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as SQL Injection. This could allow a low-privileged attacker with remote access to potentially exploit the vulnerability, leading to information disclosure.

Recommendations: For Dell OpenManage Enterprise versions OME 4.1 and prior, consider restricting access to the SQL command functionality until a patch is available. As a temporary workaround, avoid using user-input data in SQL commands to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-08732

CVE-2024-45767

Affected Products

Dell Openmanage Enterprise

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-45767 · Security Note
• https://dell.com/support/kbdoc/en-us/000237300/dsa-2024-426-security-update-for-dell-openmanage-enterprise-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45767 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08732 · Security Note
• https://t.me/cvenotify/98411 · Telegram Post
• https://vuldb.com/?id.280708 · Note
• https://t.me/cvedetector/8139 · Telegram Post
• https://twitter.com/CVEnew/status/1846761022876750198 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1846826409773117925 · Twitter Post