Multiple vulnerabilities in Dell Data Protection Central

1) Input validation error

EUVDB-ID: #VU75361

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-24593

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when handling a text-form variant. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper Preservation of Permissions

EUVDB-ID: #VU74189

Risk: Low

CVSSv4.0: 0.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-25809

CWE-ID: CWE-281 - Improper preservation of permissions

Exploit availability: No

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to the rootless "/sys/fs/cgroup" is writable when cgroupns is not unshared. A local administrator can gain the write access to user-owned cgroup hierarchy "/sys/fs/cgroup/user.slice/..." on the host.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Link following

EUVDB-ID: #VU75484

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-25652

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a symlink following issue in "git apply --reject". A local user can create a specially crafted symbolic link to write files outside of the worktree.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU72050

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-25193

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in hb-ot-layout-gsubgpos.hh. A remote attacker can use consecutive marks during the process of looking back for base glyphs when attaching marks and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper Privilege Management

EUVDB-ID: #VU72320

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-25173

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper privilege management where supplementary groups are not set up properly inside a container. A local user can use supplementary group access to bypass primary group restrictions and compromise the container.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource exhaustion

EUVDB-ID: #VU72319

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-25153

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when importing an OCI image. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Race condition

EUVDB-ID: #VU76024

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-2483

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition in Qualcomm EMAC Gigabit Ethernet Controller. An attacker with physical access to system can remove the device before cleanup in the emac_remove() function is called, trigger a use-after-free error and crash the kernel.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Cleartext transmission of sensitive information

EUVDB-ID: #VU72336

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-23915

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Exploit availability: No

The vulnerability allows a remote attacker to perform MitM attack.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Out-of-bounds write

EUVDB-ID: #VU75998

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-26551

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error within mstolfp in libntp/mstolfp.c. A remote attacker with control over a malicious NTP server can trick the victim into connecting to it, trigger an out-of-bounds write and execute arbitrary code on the target system via the client ntpq process.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Cleartext transmission of sensitive information

EUVDB-ID: #VU72335

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-23914

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Exploit availability: No

The vulnerability allows a remote attacker to perform MitM attack.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Improper input validation

EUVDB-ID: #VU75266

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-21968

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Improper input validation

EUVDB-ID: #VU75261

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-21967

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the JSSE component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Improper input validation

EUVDB-ID: #VU75262

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-21954

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Improper input validation

EUVDB-ID: #VU75264

Risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2023-21939

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Swing component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

15) Improper input validation

EUVDB-ID: #VU75265

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-21938

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Insufficient verification of data authenticity

EUVDB-ID: #VU75485

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-25815

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

The vulnerability allows a local user to tamper with Git messages.

The vulnerability exists due to the way Git processes localized messages. A local user on a multi-user machine can display a malicious message to the user.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Double Free

EUVDB-ID: #VU73830

Risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2023-27537

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when sharing HSTS data between connection. A remote attacker can initiate HSTS connection, trigger a double free error and execute arbitrary code on the target system.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Improper input validation

EUVDB-ID: #VU75260

Risk: Medium

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-21930

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the JSSE component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Buffer overflow

EUVDB-ID: #VU74627

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-28772

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the seq_buf_putmem_hex() function in lib/seq_buf.c. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Race condition

EUVDB-ID: #VU75996

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-30772

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows an attacker to compromise the affected system.

The vulnerability exists due to a race condition in rivers/power/supply/da9150-charger.c in Linux kernel. An attacker with physical access to device can trigger a race condition while unplugin the device and execute arbitrary code on the system.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU75432

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-30630

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions when executing the command with the "--dump-bin" option. A local user can overwrite arbitrary files on the system and escalate privileges.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Buffer overflow

EUVDB-ID: #VU75141

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-29491

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing malformed data in a terminfo database file. A local user can trigger memory corruption and execute arbitrary code on the target system.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Resource management error

EUVDB-ID: #VU74862

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-29469

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources when working with hashes of empty dict strings. A remote attacker can and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Improper Neutralization of Special Elements in Output Used by a Downstream Component

EUVDB-ID: #VU75589

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-29383

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Exploit availability: No

The vulnerability allows a local user to inject arbitrary code.

The vulnerability exists due to an input validation error when processing fields provided to the SUID program chfn (change finger). A local user can inject and execute arbitrary code or misrepresent existing files.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Input validation error

EUVDB-ID: #VU75486

Risk: Low

CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2023-29007

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

The vulnerability allows an attacker to tamper with Git configuration.

The vulnerability exists due to insufficient input validation in "git submodule deinit" when renaming or deleting a section from a configuration file. A remote attacker can trick the victim into running the command a malicious configuration file and tamper with Git configuration on the affected system.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

26) Improper Preservation of Permissions

EUVDB-ID: #VU74193

Risk: Medium

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-28642

CWE-ID: CWE-281 - Improper preservation of permissions

Exploit availability: No

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper preservation of permissions in the AppArmor and SELinux when /proc inside the container is symlinked with a specific mount configuration. A remote attacker can gain access to the target application.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Improper access control

EUVDB-ID: #VU74190

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-27561

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to improper access restrictions in the libcontainer/rootfs_linux.go. A local user can gain elevated privileges on the target system.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) NULL pointer dereference

EUVDB-ID: #VU74863

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-28484

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in xmlSchemaFixupComplexType. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Double Free

EUVDB-ID: #VU74147

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-28464

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the hci_conn_cleanup() function in net/bluetooth/hci_conn.c in Linux kernel. A local user can trigger a double free error and execute arbitrary code with elevated privileges.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Expected behavior violation

EUVDB-ID: #VU76238

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-28322

CWE-ID: CWE-440 - Expected Behavior Violation

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a logic error when sending HTTP POST and PUT requests using the same handle. The libcurl can erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. As a result, the application can misbehave and either send off the wrong data or use memory after free or similar in the second transfer.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Improper certificate validation

EUVDB-ID: #VU76237

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-28321

CWE-ID: CWE-295 - Improper Certificate Validation

Exploit availability: No

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper certificate validation when matching wildcards in TLS certificates for IDN names. A remote attacker crate a specially crafted certificate that will be considered trusted by the library.

Successful exploitation of the vulnerability requires that curl is built to use OpenSSL, Schannel or Gskit.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Improper synchronization

EUVDB-ID: #VU76235

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-28320

CWE-ID: CWE-662 - Improper Synchronization

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper synchronization when resolving host names using the alarm() and siglongjmp() function. A remote attacker can force the application to crash by influencing contents of the global buffer.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Use-after-free

EUVDB-ID: #VU76233

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-28319

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a use-after-free error when checking the SSH sha256 fingerprint. A remote attacker can use the application to connect to a malicious SSH server, trigger a use-after-free error and gain access to potentially sensitive information.

Successful exploitation of the vulnerability requires usage of the the CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 option, and also CURLOPT_VERBOSE or CURLOPT_ERRORBUFFER options have to be set.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Improper input validation

EUVDB-ID: #VU75267

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-21937

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Networking component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Use-after-free

EUVDB-ID: #VU75994

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-2162

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a use-after-free error within the scsi_sw_tcp_session_create() function in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. A local user can trigger a use-after-free error and gain access to sensitive information.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Double Free

EUVDB-ID: #VU56610

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-22945

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when sending data to an MQTT server. A remote attacker with ability to control libcurl input can trigger a double free error and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Cleartext transmission of sensitive information

EUVDB-ID: #VU63011

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-30115

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to an error in HSTS implementation that can allow curl to continue using HTTP protocol instead of HTTPS if the host name in the given URL used a trailing dot while not using one when it built the HSTS cache. A remote attacker with ability to intercept traffic can obtain potentially sensitive information.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Input validation error

EUVDB-ID: #VU63007

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-27780

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to bypass filters and checks.

The vulnerability exists due to the curl URL parser wrongly accepts percent-encoded URL separators like '/' when decoding the host name part of a URL, making it a different URL using the wrong host name when it is later retrieved. For example, the URL like http://example.com%2F10.0.0.1/, would be allowed by the parser and get transposed into http://example.com/10.0.0.1/.

A remote attacker can bypass various internal filters and checks and force the curl to connect to a wrong web application.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Information disclosure

EUVDB-ID: #VU63005

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-27779

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to libcurl wrongly allows HTTP cookies to be set for Top Level Domains (TLDs) if the host name is provided with a trailing dot. As a result, an attacker can create cookie files that are later sent to a different and unrelated site or domain.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Improper control of a resource through its lifetime

EUVDB-ID: #VU63004

Risk: Low

CVSSv4.0: 0.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-27778

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

Exploit availability: No

The vulnerability allows a remote attacker to delete files on the system.

The vulnerability exists in the curl command line tool when --no-clobber is used together with --remove-on-error. A remote attacker can trick the victim to connect to a malicious server and force the command line tool to remove unexpected files.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Resource management error

EUVDB-ID: #VU62643

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-27775

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper management of internal resources when handling IPv6 protocol. Due to errors in the logic, the config matching function did not take the IPv6 address zone id into account which could lead to libcurl reusing the wrong connection when one transfer uses a zone id and a subsequent transfer uses another (or no) zone id.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Memory leak

EUVDB-ID: #VU74626

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-3923

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due memory leak within RDMA over infiniband implementation in Linux kernel. A local user can force the application to leak memory by sensing commands to the /dev/infiniband/rdma_cm device node and gain access to sensitive information.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Use-after-free

EUVDB-ID: #VU53589

Risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-22901

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to crash the application or compromise the vulnerable system.

The vulnerability exists due to a use-after-free error when processing creation of new TLS sessions or during client certificate negotiation. A remote attacker can force the application to connect to a malicious server, trigger a use-after-free error and crash the application.

Remote code execution is also possible if the application can be forced to initiate multiple transfers with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection in order to inject a crafted memory content into the correct place in memory.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system but requires that libcurl is using OpenSSL.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Incorrect default permissions

EUVDB-ID: #VU64684

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-32207

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to incorrect default permissions set to cookies, alt-svc and hsts data stored in local files. A local user with ability to read such files can gain access to potentially sensitive information.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Man-in-the-Middle (MitM) attack

EUVDB-ID: #VU51822

Risk: Medium

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-22890

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

Exploit availability: No

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to an error when handling TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. The reason for this confusion is the modified sequence from TLS 1.2 when the session ids would provided only during the TLS handshake, while in TLS 1.3 it happens post hand-shake and the code was not updated to take that changed behavior into account.

When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed.

This flaw can allow a malicious HTTPS proxy to MITM the traffic. Such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Information disclosure

EUVDB-ID: #VU29292

Risk: Medium

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-8169

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to cURL sends a DNS query with the provided credentials for HTTP authentication when processing redirects. A remote attacker that controls a DNS server can gain access to HTTP authenticated credentials.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Uncontrolled Recursion

EUVDB-ID: #VU75206

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-36691

CWE-ID: CWE-674 - Uncontrolled Recursion

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to uncontrolled recursion in lib/nlattr.c. A local user can use a nested Netlink policy with a back reference to crash the kernel.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Integer overflow

EUVDB-ID: #VU18583

Risk: Medium

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-5435

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in curl_url_set() function on 32-bit systems. A remote attacker can pass an overly long URL to the affected application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Input validation error

EUVDB-ID: #VU24338

Risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2019-15601

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied URL. A remote attacker can pass  URL to the SMB share using the "file://" URI handler and read arbitrary files from local resources.

Example: file://localhost//hostname/home/secret.txt

Note, this issue affects Windows installations only.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

50) Resource exhaustion

EUVDB-ID: #VU64681

Risk: Medium

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-32205

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to curl does not impose limits to the size of cookies stored in the system. A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and consume all available disk space.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Incorrect calculation

EUVDB-ID: #VU72477

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-33972

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to incorrect calculation in microcode keying mechanism. A local user can gain access to sensitive information.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Out-of-bounds read

EUVDB-ID: #VU75323

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-2124

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack..

The vulnerability exists due to a boundary condition within the XFS subsystem in Linux kernel. A local user can trigger an out-of-bounds read error and crash the kernel.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Improper Initialization

EUVDB-ID: #VU74630

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-1513

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to improper initialization when calling the KVM_GET_DEBUGREGS ioctl on 32-bit systems. A local user can run a specially crafted application to gain access to sensitive information.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Security features bypass

EUVDB-ID: #VU75454

Risk: Low

CVSSv4.0: 5.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2023-1998

CWE-ID: CWE-254 - Security Features

Exploit availability: Yes

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to incorrect implementation of the Spectre v2 SMT mitigations, related to calling prctl with PR_SET_SPECULATION_CTRL. An attacker can gain unauthorized access to kernel memory from userspace.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

55) Use-after-free

EUVDB-ID: #VU75453

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-1990

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the ndlc_remove() function in drivers/nfc/st-nci/ndlc.c. A local user can trigger a use-after-free error and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Use-after-free

EUVDB-ID: #VU75452

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-1989

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the btsdio_remove() function in driversluetoothtsdio.c. A local user can trigger a use-after-free error and escalate privileges on the system.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Use-after-free

EUVDB-ID: #VU75451

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-1855

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the xgene_hwmon_remove() function in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-hwmon). A local user can trigger a use-after-free error and execute arbitrary code on the system.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Use-after-free

EUVDB-ID: #VU75450

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-1670

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the Xircom 16-bit PCMCIA (PC-card) Ethernet driver. A local user can trigger a use-after-free error and execute arbitrary code on the system.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Use-after-free

EUVDB-ID: #VU75204

Risk: Low

CVSSv4.0: 1.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-1611

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the btrfs_search_slot() function in fs/btrfs/ctree.c. A local user can trigger a use-after-free error and crash the kernel.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Infinite loop

EUVDB-ID: #VU74631

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-1390

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in tipc_link_xmit() within the Linux kernel TIPC kernel module when parsing UDp packets. A remote attacker can send two small UDP packets to a system with a UDP bearer and consume all available CPU resources.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Stack-based buffer overflow

EUVDB-ID: #VU68747

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-35260

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when parsing .netrc file. A local user can pass a specially crafted file to the curl, trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Use-after-free

EUVDB-ID: #VU74122

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-1281

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in Linux kernel traffic control index filter (tcindex) when the tcf_exts_exec() function is called with the destroyed tcf_ext. A local user attacker can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Security features bypass

EUVDB-ID: #VU74149

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-0466

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to an error within the X509_VERIFY_PARAM_add0_policy() function, which does not perform the certificate policy check despite being implicitly enabled. A remote attacker can bypass expected security restrictions and perform MitM attack.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Improper Verification of Cryptographic Signature

EUVDB-ID: #VU74148

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-0465

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to an error when validating certificate policies in leaf certificates. A remote attacker that controls a malicious CA server can issue a certificate that will be validated by the application.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Resource exhaustion

EUVDB-ID: #VU73960

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-0464

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when verifying X.509 certificate chains that include policy constraints. A remote attacker can create a specially crafted certificate to trigger resource exhaustion and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Security features bypass

EUVDB-ID: #VU70457

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-43551

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists in the way curl handles IDN characters in hostnames. The HSTS mechanism could be bypassed if the hostname in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Then in a subsequent request it does not detect the HSTS state and makes a clear text transfer.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Cleartext transmission of sensitive information

EUVDB-ID: #VU68749

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-42916

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to an error when parsing URL with IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. A remote attacker can bypass curl's HSTS check and trick it into using unencrypted HTTP protocol.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Double Free

EUVDB-ID: #VU68748

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-42915

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing non-200 proxy HTTP responses for the following schemes: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, telnet. A remote attacker can trigger a double free error by forcing the application into connecting to resources that are not allowed by the configured proxy.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Inadequate encryption strength

EUVDB-ID: #VU53584

Risk: Low

CVSSv4.0: 0.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-22897

CWE-ID: CWE-326 - Inadequate Encryption Strength

Exploit availability: No

The vulnerability allows a remote attacker to force applications use weak cryptographic ciphers.

The vulnerability exists due to a logic error when selecting TLS ciphers during connection via the CURLOPT_SSL_CIPHER_LIST option in libcurl. The selected cipher set was stored in a single "static" variable in the library that is used for multiple concurrent transfers within the specific application, the last one that sets the ciphers will accidentally control the set used by all transfers.

The vulnerability can be triggered when Schannel is used, which is the native TLS library in Microsoft Windows.

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Use of uninitialized variable

EUVDB-ID: #VU53587

Risk: Medium

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-22898

CWE-ID: CWE-457 - Use of Uninitialized Variable

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to usage of uninitialized variable in code, responsible for processing TELNET requests when parsing NEW_ENV variables. A remote attacker can force the affected application to connect to a telnet server under attackers control and read up to 1800 bytes from the uninitialized memory on the libcurl client system.

Proof of concept:

curl telnet://example.com -tNEW_ENV=a,bbbbbb (256 'b's)

Install update from vendor's website.

Dell EMC PowerProtect Data Protection: All versions

Dell Data Protection Central: All versions

• cpe:2.3:a:dell:dell_emc_powerprotect_data_protection:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:dell_data_protection_central:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000215713/dsa-2023-237-security-update-for-dell-data-protection-central-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.