PT-2024-9311 · Dell · Dell Openmanage Server Administrator

Published 2024-12-06 · Updated 2025-02-04 · CVE-2024-45761

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Dell OpenManage Server Administrator versions 11.0.1.0 and prior

Description: The issue is related to improper input validation, which could be exploited by a remote low-privileged malicious user to load any web plugins or Java class. This could lead to the possibility of altering the behavior of certain apps/OS or Denial of Service.

Recommendations: For versions 11.0.1.0 and prior, consider disabling the ability to load web plugins or Java classes as a temporary workaround until a patch is available. Restrict access to the Dell OpenManage Server Administrator to minimize the risk of exploitation. Avoid using any potentially vulnerable features or functions in the affected software until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-11000

CVE-2024-45761

Affected Products

Dell Openmanage Server Administrator

References · 10

• https://dell.com/support/kbdoc/en-us/000258320/dsa-2024-481-security-update-for-dell-openmanage-server-administrator-omsa-vulnerability · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-11000 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-45761 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45761 · Vendor Advisory
• https://vuldb.com/?id.287451 · Note
• https://twitter.com/CVEnew/status/1866432948850823311 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1866292380493557822 · Twitter Post
• https://t.me/cvenotify/109934 · Telegram Post
• https://t.me/cvenotify/103580 · Telegram Post
• https://t.me/cvedetector/12417 · Telegram Post