Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection vulnerability in an admin operation. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the system application's underlying OS with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker.
References
Configurations
Configuration 1 (hide)
|
History
23 Sep 2024, 21:01
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| References | () https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities - Vendor Advisory | |
| CPE | cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:* | |
| First Time |
Dell data Domain Operating System
Dell |
26 Jun 2024, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-26 04:15
Updated : 2024-09-23 21:01
NVD link : CVE-2024-37140
Mitre link : CVE-2024-37140
JSON object : View
Products Affected
dell
- data_domain_operating_system
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')