CVE-2023-32450

Dell Power Manager, Versions 3.3 to 3.14 contains an Improper Access Control vulnerability. A low-privileged malicious user may potentially exploit this vulnerability to perform arbitrary code execution with limited access.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000215215/dsa-2023-181-dell-power-manager-security-update-for-an-improper-access-control-vulnerability	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dell:power_manager:*:*:*:*:*:*:*:*

History

02 Aug 2023, 22:13

Type	Values Removed	Values Added
CPE		cpe:2.3:a:dell:power_manager::::::::
CWE	~~CWE-379~~	NVD-CWE-Other
References	~~(MISC) https://www.dell.com/support/kbdoc/en-us/000215215/dsa-2023-181-dell-power-manager-security-update-for-an-improper-access-control-vulnerability -~~	(MISC) https://www.dell.com/support/kbdoc/en-us/000215215/dsa-2023-181-dell-power-manager-security-update-for-an-improper-access-control-vulnerability - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8
First Time		Dell power Manager Dell

27 Jul 2023, 05:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-07-27 05:15

Updated : 2023-12-10 15:14

NVD link : CVE-2023-32450

Mitre link : CVE-2023-32450

CVE.ORG link : CVE-2023-32450

JSON object : View

Products Affected

dell

power_manager

CWE

NVD-CWE-Other CWE-379

Creation of Temporary File in Directory with Insecure Permissions

{"id": "CVE-2023-32450", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 1.8}]}, "published": "2023-07-27T05:15:10.363", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000215215/dsa-2023-181-dell-power-manager-security-update-for-an-improper-access-control-vulnerability", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-379"}]}], "descriptions": [{"lang": "en", "value": "\nDell Power Manager, Versions 3.3 to 3.14 contains an Improper Access Control vulnerability. A low-privileged malicious user may potentially exploit this vulnerability to perform arbitrary code execution with limited access.\n\n"}, {"lang": "es", "value": "Dell Power Manager en versiones de la 3.3 hasta la 3.14 contiene una vulnerabilidad de control de acceso inadecuado. Un usuario malintencionado con pocos privilegios podr\u00eda aprovechar esta vulnerabilidad para ejecutar c\u00f3digo arbitrario con acceso limitado. "}], "lastModified": "2023-08-02T22:13:42.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:power_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87F6B871-B6D8-4FB1-8D38-4A8FBA25DF08", "versionEndExcluding": "3.15", "versionStartIncluding": "3.3"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}