PT-2024-9646 · Dell · Dell Ecs

Published 2024-06-19 · Updated 2024-12-09 · CVE-2024-38485

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dell ECS versions prior to 3.8.0

Description The issue is related to a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that lead to sensitive information leakage. The vulnerability may allow an attacker to redirect users to an arbitrary URL, potentially causing confidential information leakage.

Recommendations For versions prior to 3.8.0, update to version 3.8.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information and implementing additional security measures to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2024-11358

CVE-2024-38485

Affected Products

Dell Ecs

References · 6

• https://dell.com/support/kbdoc/en-us/000256185/dsa-2024-331-security-update-for-dell-ecs-host-header-injection-vulnerability · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38485 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38485 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-11358 · Security Note
• https://t.me/cvedetector/12408 · Telegram Post
• https://twitter.com/CVEnew/status/1866139794453213228 · Twitter Post