Lucene search

DellCVE-2019-3764

HistoryNov 07, 2019 - 6:15 p.m.

CVE-2019-3764

2019-11-0718:15:12

CWE-285

dell

web.nvd.nist.gov

cve-2019-3764

dell emc

idrac

authorization vulnerability

remote exploitation

sensitive information disclosure

password hashes

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.3

Confidence

High

EPSS

0.001

Percentile

35.3%

JSON

Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an improper authorization vulnerability. A remote authenticated malicious iDRAC user with low privileges may potentially exploit this vulnerability to obtain sensitive information such as password hashes.

Affected configurations

Nvd

Node

dellidrac7_firmwareRange<2.65.65.65

dellidrac8_firmwareRange<2.70.70.70

dellidrac9_firmwareRange<3.36.36.36

VendorProductVersionCPE
dellidrac7_firmware*cpe:2.3:o:dell:idrac7_firmware:*:*:*:*:*:*:*:*
dellidrac8_firmware*cpe:2.3:o:dell:idrac8_firmware:*:*:*:*:*:*:*:*
dellidrac9_firmware*cpe:2.3:o:dell:idrac9_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	idrac7_firmware	*	cpe:2.3:o:dell:idrac7_firmware::::::::
dell	idrac8_firmware	*	cpe:2.3:o:dell:idrac8_firmware::::::::
dell	idrac9_firmware	*	cpe:2.3:o:dell:idrac9_firmware::::::::

CNA Affected

[
  {
    "product": "Integrated Dell Remote Access Controller (iDRAC)",
    "vendor": "Dell",
    "versions": [
      {
        "lessThan": "iDRAC7: 2.65.65.65, iDRAC8: 2.70.70.70, iDRAC9: 3.40.40.40 and 3.36.36.36",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.dell.com/support/article/sln319317/dsa-2019-137-idrac-improper-authorization-vulnerability?lang=en

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.3

Confidence

High

EPSS

0.001

Percentile

35.3%

JSON

Related for CVE-2019-3764