PT-2024-9592 · Dell+1 · Dell Recoverpoint For Virtual Machines+1

Published 2024-12-13 · Updated 2024-12-14 · CVE-2024-48008

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dell RecoverPoint for Virtual Machines versions 6.0.x

Description The issue is related to an OS Command Injection vulnerability. A low-privileged remote attacker could potentially exploit this vulnerability, leading to information disclosure. This could allow unintended actions, such as reading files that may contain sensitive information. The vulnerability is associated with a configuration error in ASP.NET, specifically the creation of a debug binary file.

Recommendations For Dell RecoverPoint for Virtual Machines version 6.0.x, consider restricting access to sensitive files and configuring the system to minimize the risk of exploitation until a patch is available. As a temporary workaround, restrict the use of system commands to prevent potential information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

CWE-11

Related Identifiers

BDU:2024-11301

CVE-2024-48008

Affected Products

Asp.Net

Dell Recoverpoint For Virtual Machines

References · 6

• https://dell.com/support/kbdoc/en-us/000259765/dsa-2024-429-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-48008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48008 · Security Note
• https://bdu.fstec.ru/vul/2024-11301 · Security Note
• https://twitter.com/CVEnew/status/1868033928415805500 · Twitter Post
• https://t.me/cvedetector/12870 · Telegram Post