Dell EMC Enterprise Hybrid Cloud update for VMware products

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to missing authentication to the appliance management API. A remote non-authenticated attacker can with access to port 443/TCP can gain access to sensitive information on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper Authorization

EUVDB-ID: #VU56795

Risk: High

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2021-22006

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to gain unauthorized access to the system.

The vulnerability exist due to improper URI handling in reverse proxy. A remote non-authenticate attacker can send a specially crafted HTTP request to port 443/TCP and access restricted endpoints.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Information disclosure

EUVDB-ID: #VU56796

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-22007

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in the Analytics service. A local user can gain unauthorized access to sensitive information on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Information disclosure

EUVDB-ID: #VU56797

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-22008

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in VAPI (vCenter API) service. A remote attacker with access to port 443/TCP can gain unauthorized access to sensitive information on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource exhaustion

EUVDB-ID: #VU56798

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-22009

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the VAPI (vCenter API) service. A remote attacker can send specially crafted HTTP request to port 443/TCP and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Resource exhaustion

EUVDB-ID: #VU56799

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-22010

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the VPXD (Virtual Provisioning X Daemon) service. A remote attacker can send a secially crafted HTTP request to port 443/TCP and consume all available memory resources.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper Authentication

EUVDB-ID: #VU56800

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-22011

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to missing authentication for an API endpoint in vCenter Server Content Library. A remote non-authenticated attacker with access to port 443/TCP can gain unauthorized access to the system and perform unauthenticated VM network setting manipulation.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Path traversal

EUVDB-ID: #VU56802

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-22013

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the appliance management API. A remote non-authenticated attacker can send a specially crafted HTTP request to port 443/TCP and read arbitrary files on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU56793

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-21993

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

Description

The disclosed vulnerability allows a remote user to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input. A remote user can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Code Injection

EUVDB-ID: #VU56803

Risk: Low

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-22014

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in VAMI (Virtual Appliance Management Infrastructure). A remote authenticated VAMI user can send a specially crafted request to port 5480/TCP and execute arbitrary code on the target system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Incorrect default permissions

EUVDB-ID: #VU56804

Risk: Low

CVSSv4.0: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Clear]

CVE-ID: CVE-2021-22015

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for files and folders that are set by the system. A local user with access to the system can escalate privilege to root on vCenter Server Appliance.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.

13) Cross-site scripting

EUVDB-ID: #VU56805

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-22016

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Improper Authorization

EUVDB-ID: #VU56806

Risk: Medium

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:A/U:Green]

CVE-ID: CVE-2021-22017

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to the system.

The vulnerability exist due to improper implementation of URI normalization in rhttpproxy. A remote non-authenticate attacker can request a specially crafted URL, bypass rhttpproxy and access internal endpoints.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

15) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU56807

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-22018

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to delete arbitrary files on the system.

The vulnerability exists due to improperly imposed security restrictions in a VMware vSphere Life-cycle Manager plug-in. A remote non-authenticated attacker can send a specially crafted request to port 9087/TCP and delete non critical files.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Input validation error

EUVDB-ID: #VU56808

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-22019

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in VAPI (vCenter API) service. A remote attacker can pass specially crafted crafted jsonrpc message to port 5480/TCP and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Input validation error

EUVDB-ID: #VU56809

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-22020

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the Analytics service. A remote user can send a specially crafted request to the application and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Arbitrary file upload

EUVDB-ID: #VU56794

Risk: Critical

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2021-22005

CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload within the Analytics service. A remote non-authenticated attacker with network access to port 443/TCP can upload and execute arbitrary file on the server.

Successful exploitation of the vulnerability may results in full compromise of the affected system.

Note, we are aware of the vulnerability being exploited in the wild as of September 23.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

19) Input validation error

EUVDB-ID: #VU56792

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-21992

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when parsing XML data. A remote user can pass specially crafted XML data to the application and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Arbitrary file upload

EUVDB-ID: #VU51808

Risk: Medium

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Green]

CVE-ID: CVE-2021-21983

CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type

Exploit availability: Yes

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload in vRealize Operations Manager API. A remote privileged user can upload a malicious file and execute it on the server.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.

21) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU55615

Risk: High

CVSSv4.0: 6.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-22002

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in the /cfg web app and diagnostic endpoints. A remote attacker can send a specially crafted HTTP request with a modified HTTP Host header to port 443/TCP and access the /cfg web application, available at port 8443. As a result, a remote non-authenticated attacker can perform SSRF attack and gain access to services in the internal network.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Code Injection

EUVDB-ID: #VU53608

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21984

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an unauthorised endpoint. A remote attacker can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Input validation error

EUVDB-ID: #VU53595

Risk: Critical

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2021-21985

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input within the Virtual SAN Health Check plug-in, which is enabled by default. A remote non-authenticated attacker can send a specially crafted HTTP request to the vSphere Client available at port 443/tcp and execute arbitrary commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

24) Improper Authentication

EUVDB-ID: #VU53596

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-21986

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests to the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A remote non-authenticated attacker can bypass authentication process and gain unauthorized access to the application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Input validation error

EUVDB-ID: #VU54215

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-21997

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the VM3DMP driver. A local unprivileged user on the guest operating system can trigger panic in the VM3DMP and perform a denial of service (DoS) attack against the guest operating system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Unquoted Search Path or Element

EUVDB-ID: #VU54314

Risk: Low

CVSSv4.0: 5.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-21999

CWE-ID: CWE-428 - Unquoted Search Path or Element

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to uncontrolled search path within the VGAuthService service when validating a user-supplied OpenSSL configuration file prior to using it. A local user can supply a specially crafted file to execute arbitrary code in the context of SYSTEM.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Improper Authentication

EUVDB-ID: #VU54814

Risk: High

CVSSv4.0: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21994

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests in SFCB (Small Footprint CIM Broker). A remote attacker can send specially crafted requests to port 5989/tcp, bypass SFCB authentication and gain unauthorized access to the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Out-of-bounds read

EUVDB-ID: #VU54816

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-21995

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition when processing requests within the OpenSLP service. A remote attacker can send a specially crafted request to port 427/UDP, trigger a heap out-of-bounds read and perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Unprotected primary channel

EUVDB-ID: #VU55616

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-22003

CWE-ID: CWE-419 - Unprotected primary channel

Exploit availability: No

Description

undefined

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU56791

Risk: Low

CVSSv4.0: 7.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Clear]

CVE-ID: CVE-2021-21991

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way the vCenter Server handles session tokens. A local user can escalate privileges to Administrator on the vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash).

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Information disclosure

EUVDB-ID: #VU56081

Risk: Low

CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-22022

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote administrator can gain unauthorized access to sensitive information on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Input validation error

EUVDB-ID: #VU56082

Risk: Low

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-22023

https://www.dell.com/support/kbdoc/fr-fr/printview/000192301/10/en

Exploit availability: No

Description

The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to insecure direct object reference issue. A remote administrator can modify other users information leading to an account takeover.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell Enterprise Hybrid Cloud: 4.1.0 - 4.1.1

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Information disclosure

EUVDB-ID: #VU56083

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-22024