CVE-2024-22426
Assigner: dell
Published: 2024-02-16T11:20:35.039Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: RecoverPoint for VMs
vendor: Dell
versions: status: affected
version: 5.3 SP2
status: affected
version: 5.3 SP2 P1
status: affected
version: 5.3 SP2 P2
status: affected
version: 5.3 SP2 P4
status: affected
version: 5.3 SP3 P1
status: affected
version: 5.3 SP3 P2
datePublic: 2024-02-16T06:30:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">Dell RecoverPoint for Virtual Machines 5.3.x contains an OS Command injection vulnerability. An unauthenticated remote</span><br><span style="background-color: rgb(255, 255, 255);">attacker could potentially exploit this vulnerability, leading to execute arbitrary operating system commands, which will get executed in the context of the root user, resulting in a complete system compromise.</span>


value: 
Dell RecoverPoint for Virtual Machines 5.3.x contains an OS Command injection vulnerability. An unauthenticated remote
attacker could potentially exploit this vulnerability, leading to execute arbitrary operating system commands, which will get executed in the context of the root user, resulting in a complete system compromise.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
type: CWE
source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.1.0-dev