CVE-2019-3765

Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1, 2.2, 2.3 and 2.4 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A remote authenticated malicious user potentially could exploit this vulnerability to view or modify sensitive backup data. This could be used to make backups corrupt or potentially to trick a user into restoring a backup with malicious files in place.

CVSS v3 8.1 HIGH
CVSS v2.0 5.5 MEDIUM

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:N

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://www.dell.com/support/security/en-us/details/537649/DSA-2019-138-Dell-EMC-Avamar-Incorrect-Permission-Assignment-for-Critical-Resource-Vulnerability	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dell:emc_avamar_server:7.4.1:::::::*
	cpe:2.3:a:dell:emc_avamar_server:7.5.0:::::::*
	cpe:2.3:a:dell:emc_avamar_server:7.5.1:::::::*
	cpe:2.3:a:dell:emc_avamar_server:18.2:::::::*
	cpe:2.3:a:dell:emc_avamar_server:19.1:::::::*
	cpe:2.3:a:dell:emc_integrated_data_protection_appliance::::::::

History

No history.

Information

Published : 2019-10-09 20:15

Updated : 2023-12-10 13:13

NVD link : CVE-2019-3765

Mitre link : CVE-2019-3765

CVE.ORG link : CVE-2019-3765

JSON object : View

Products Affected

dell

emc_avamar_server
emc_integrated_data_protection_appliance

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2019-3765", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.7}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2019-10-09T20:15:27.800", "references": [{"url": "https://www.dell.com/support/security/en-us/details/537649/DSA-2019-138-Dell-EMC-Avamar-Incorrect-Permission-Assignment-for-Critical-Resource-Vulnerability", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}, {"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1, 2.2, 2.3 and 2.4 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A remote authenticated malicious user potentially could exploit this vulnerability to view or modify sensitive backup data. This could be used to make backups corrupt or potentially to trick a user into restoring a backup with malicious files in place."}, {"lang": "es", "value": "Dell EMC Avamar Server versiones 7.4.1, 7.5.0, 7.5.1, 18.2 y 19.1 y Dell EMC Integrated Data Protection Appliance (IDPA) versiones 2.0, 2.1, 2.2, 2.3 y 2.4, contienen una Asignaci\u00f3n de Permisos Incorrecta para una vulnerabilidad de Recursos Cr\u00edticos. Un usuario malicioso autenticado remoto podr\u00eda explotar esta vulnerabilidad para visualizar o modificar datos confidenciales de respaldo. Esto podr\u00eda usarse para corromper las copias de seguridad o para enga\u00f1ar potencialmente a un usuario para que restaure una copia de seguridad con archivos maliciosos en su lugar."}], "lastModified": "2019-10-17T17:33:19.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:emc_avamar_server:7.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D31DB2E9-502A-4097-B7D0-01BD33CB5DC3"}, {"criteria": "cpe:2.3:a:dell:emc_avamar_server:7.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2505F76D-6AB8-489A-AB9D-9069B9A9025E"}, {"criteria": "cpe:2.3:a:dell:emc_avamar_server:7.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5714A80-1068-4C43-AF9F-2176C72D1416"}, {"criteria": "cpe:2.3:a:dell:emc_avamar_server:18.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "52BE822E-6FD6-4FC8-9DFC-A4073D31B58C"}, {"criteria": "cpe:2.3:a:dell:emc_avamar_server:19.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D055384E-1362-43FC-BD4C-9FAED912FE1F"}, {"criteria": "cpe:2.3:a:dell:emc_integrated_data_protection_appliance:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "430C90BD-C302-42BE-9292-4B6B3F47E955", "versionEndIncluding": "2.4", "versionStartIncluding": "2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}