Lucene search

DellCVE-2021-21524

HistoryApr 12, 2021 - 8:15 p.m.

CVE-2021-21524

2021-04-1220:15:11

CWE-502

dell

web.nvd.nist.gov

dell

srm

smr

untrusted deserialization

vulnerability

cve-2021-21524

nvd

security advisory

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.004

Percentile

73.5%

JSON

Dell SRM versions prior to 4.5.0.1 and Dell SMR versions prior to 4.5.0.1 contain an Untrusted Deserialization Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability, leading to arbitrary privileged code execution on the vulnerable application. The severity is Critical as this may lead to system compromise by unauthenticated attackers.

Affected configurations

Nvd

Vulners

Node

dellstorage_monitoring_and_reportingRange<4.5.0.1

dellstorage_resource_managerRange<4.5.0.1

VendorProductVersionCPE
dellstorage_monitoring_and_reporting*cpe:2.3:a:dell:storage_monitoring_and_reporting:*:*:*:*:*:*:*:*
dellstorage_resource_manager*cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	storage_monitoring_and_reporting	*	cpe:2.3:a:dell:storage_monitoring_and_reporting::::::::
dell	storage_resource_manager	*	cpe:2.3:a:dell:storage_resource_manager::::::::

CNA Affected

[
  {
    "product": "Dell EMC Storage Monitoring and Reporting",
    "vendor": "Dell",
    "versions": [
      {
        "lessThan": "4.5.0.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.dell.com/support/kbdoc/en-us/000184753/dsa-2021-054-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-vulnerabilities

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.004

Percentile

73.5%

JSON

Related for CVE-2021-21524