SB2023052623 - Multiple vulnerabilities in Dell PowerPath for Windows

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023052623

SB2023052623 - Multiple vulnerabilities in Dell PowerPath for Windows

Published: May 26, 2023

Security Bulletin ID SB2023052623
Severity
Low
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Incorrect default permissions (CVE-ID: CVE-2023-28079)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local user with access to the system can view contents of files and directories or modify them.


2) Insecure DLL loading (CVE-ID: CVE-2023-28080)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the application loads DLL libraries in an insecure manner. A local user can place a specially crafted .dll file on the system and execute arbitrary code with elevated privileges.


3) Cleartext storage of sensitive information (CVE-ID: CVE-2023-32448)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to the application stores its license key stored locally in clear text. A local user with access to the installation directory can retrieve the license key of the product and use it to install and license PowerPath on different systems.


Remediation

Install update from vendor's website.

References