CVE-2023-44285 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
dell	CNA	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 19%

Vendor	Product	Version
dell	powerprotect_data_protection	𝑥 < 2.7.6
dell	apex_protection_storage	𝑥 < 6.2.1.110
dell	apex_protection_storage	7.0 ≤ 𝑥 < 7.10.1.15
dell	powerprotect_data_domain	𝑥 < 6.2.1.110
dell	powerprotect_data_domain	7.0 ≤ 𝑥 < 7.12.0.0
dell	powerprotect_data_domain_management_center	𝑥 < 6.2.1.110
dell	powerprotect_data_domain_management_center	7.0 ≤ 𝑥 < 7.13.0.10
dell	emc_data_domain_os	𝑥 < 6.2.1.110
dell	emc_data_domain_os	7.0 ≤ 𝑥 < 7.12.0.0
dell	emc_data_domain_os	7.7 ≤ 𝑥 < 7.7.5.25
dell	emc_data_domain_os	7.10 ≤ 𝑥 < 7.10.1.15
dell	powerprotect_data_domain_management_center	7.7 ≤ 𝑥 < 7.7.5.25
dell	powerprotect_data_domain_management_center	7.10 ≤ 𝑥 < 7.10.1.15

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-1220 - Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

References

https://www.dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities

https://www.dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities