Multiple vulnerabilities in Dell ESI (Enterprise Storage Integrator) for SAP LAMA

Published: 2023-08-16

Risk	High
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2023-39244 CVE-2023-39245
CWE-ID	CWE-200 CWE-284
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	ESI (Enterprise Storage Integrator) for SAP LAMA Other software / Other software solutions
Vendor	Dell

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU79576

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-39244

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain admin level credentials.

The vulnerability exists in EHAC component. A remote attacker can exploit this vulnerability by eavesdropping the network traffic to gain admin level credentials.

Mitigation

Install update from vendor's website.

Vulnerable software versions

ESI (Enterprise Storage Integrator) for SAP LAMA: 10.0

External links

http://www.dell.com/support/kbdoc/nl-nl/000216654/dsa-2023-299-security-update-for-dell-esi-enterprise-storage-integrator-for-sap-lama-multiple-security-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper access control

EUVDB-ID: #VU79577

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-39245

CWE-ID: CWE-284 - Improper Access Control