Dell Urges Customers to Patch Vulnerabilities in PowerProtect Products

Dell is urging customers of its PowerProtect products to review a newly released security advisory and patch a series of potentially serious vulnerabilities.
The vulnerabilities impact PowerProtect Data Domain series appliances, which are designed to help organizations protect, manage and recover data at scale.
The most serious of the flaws - based on its CVSS score of 8.8 - is CVE-2023-44286, described as a DOM-based cross-site scripting issue that allows a remote, unauthenticated attacker to inject malicious code into the targeted user's browser.
Exploitation could lead to client-side request forgery, session theft and information disclosure.
While it's not specified in Dell's advisory, exploiting these types of flaws typically involves the attacker tricking the victim into clicking on a malicious link.
Several other vulnerabilities have been assigned a 'high severity' rating, including OS command injection and improper access control flaws.
The command injection bugs can be exploited to execute arbitrary commands on the underlying operating system with the privileges of the vulnerable exploitation, and they could allow an attacker to take over the targeted system.
Exploitation requires local access and either low or elevated privileges.
It may be possible for an attacker to exploit a vulnerability such as CVE-2023-44286 to achieve the authentication requirement.
The three medium-severity flaws found in PowerProtect products can be exploited by an authenticated attacker to bypass security restrictions and take over the system, gain read and write access to OS files, and execute arbitrary SQL commands on the application's backend database and gain read access to app data.
The company said it worked quickly to remediate the vulnerability and it's currently not aware of any active exploitation.
It's worth noting that Dell product vulnerabilities are known to have been exploited by sophisticated threat actors in their attacks.
Dell recently also informed customers about a high-severity privilege escalation vulnerability in PowerEdge Server BIOS, dozens of flaws in PowerMax and Unisphere products, and dozens of vulnerabilities impacting third-party components of VxRail Manager.


This Cyber News was published on packetstormsecurity.com. Publication date: Thu, 14 Dec 2023 14:13:05 +0000


Cyber News related to Dell Urges Customers to Patch Vulnerabilities in PowerProtect Products

Dell Urges Customers to Patch Vulnerabilities in PowerProtect Products - Dell is urging customers of its PowerProtect products to review a newly released security advisory and patch a series of potentially serious vulnerabilities. The vulnerabilities impact PowerProtect Data Domain series appliances, which are designed to ...
1 year ago Packetstormsecurity.com CVE-2023-44286
15 Best Patch Management Tools - 2025 - What is Good?What Could Be Better?Comprehensive patch management for various operating systems, applications, and third-party software.It is complex for new users and requires time and training to utilize its functionalities fully.Advanced analytics ...
2 months ago Cybersecuritynews.com
CVE-2018-1183 - In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to ...
6 years ago
Multiple Flaws in Dell PowerProtect Products Execute Commands - Multiple vulnerabilities have been discovered in Dell's PowerProtect, which were associated with SQL injection, cross-site scripting, privilege escalation, command injection, and path tracing. The severity for these vulnerabilities ranges between 4.3 ...
1 year ago Cybersecuritynews.com CVE-2023-44286 CVE-2023-44284 CVE-2023-48668 CVE-2023-44277 CVE-2023-48667 CVE-2023-44279 CVE-2023-44278 CVE-2023-44285
Dell PowerProtect Systems Vulnerability Let Remote Attackers to Execute Arbitrary Commands - The vulnerability allows for “execution of arbitrary commands with root privileges,” essentially giving attackers complete control over affected systems. According to the security advisory, this vulnerability affects multiple versions of ...
1 month ago Cybersecuritynews.com CVE-2023-44277
Dell Data Breach Exposes Personal Information Of 49 Million - Personal details such as names and residential addresses were compromised in the breach, while sensitive financial information remained secure. Dell, the renowned computer manufacturer, has issued a cautionary notice to its customers regarding a ...
1 year ago Cysecurity.news
Dell says names, addresses leaked after hacker claims access to 49M records - Dell is warning customers that their names, physical addresses and some order information may have been accessed in a recent cybersecurity incident. A threat actor known as Menelik made a post on the cybercrime site BreachForums on April 28 claiming ...
1 year ago Packetstormsecurity.com
How Patch Management Software Solves the Update Problem - I've never met an IT leader who doesn't know how important patch management is. At Heimdal, we believe patch management software provides the solution to this problem. Patch management software is a technology that allows businesses to automate the ...
10 months ago Heimdalsecurity.com
Vulnerability Summary for the Week of November 27, 2023 - PrimaryVendor - Product apple - multiple products Description A memory corruption vulnerability was addressed with improved locking. Published 2023-12-01 CVSS Score not yet calculated Source & Patch Info CVE-2023-48842 PrimaryVendor - Product dell - ...
1 year ago Cisa.gov CVE-2023-48842 CVE-2023-43089 CVE-2023-39226 CVE-2023-46690 CVE-2023-47207 CVE-2023-46886 CVE-2023-48882 CVE-2023-49656 CVE-2023-28896 CVE-2023-48016 CVE-2023-49092 CVE-2023-2266 CVE-2023-2267 CVE-2023-31177 CVE-2023-34388 CVE-2023-34389 CVE-2023-48848 CVE-2023-4398
Ivanti urges customers to patch yet another critical vulnerability - This vulnerability only affects a limited number of supported versions-Ivanti Connect Secure, Ivanti Policy Secure version 22.5R1.1 and ZTA version 22.6R1.3. Please read between the lines that there could be unsupported versions which will never see ...
1 year ago Malwarebytes.com CVE-2024-22024
Dell warns of data breach, 49 million customers allegedly affected - Dell is warning customers of a data breach after a threat actor claimed to have stolen information for approximately 49 million customers. The computer maker began emailing data breach notifications to customers yesterday, stating that a Dell portal ...
1 year ago Bleepingcomputer.com
Key software patch testing best practices - To ensure a predictable rollout when a patch is deployed across your network, it is important to test it first in a nonproduction environment. Companies install software and firmware patches to fix bugs, remove vulnerabilities and add new features, ...
1 year ago Techtarget.com
How to conduct security patch validation and verification - Validation and verification are important steps in the security patch management lifecycle. They help to determine the impact of a patch on the security and efficiency of an organization's IT assets. Patch validation is the process of examining newly ...
1 year ago Techtarget.com
Microsoft Urges Customers to Secure Online Accounts with its Latest Identity Security Solution - Microsoft has come forward with a warning regarding identity-related security issues and urges its customers to secure their online accounts. The company has developed a new identity security solution to address this issue. ...
2 years ago Thehackernews.com
Identity Crisis: 14 Million Individuals at Risk After Mortgage Lender's Data Breach - Mr Cooper, the private mortgage lender, has now admitted almost 14.7 million individuals' private data has been stolen in a previous IT security breach, which resulted in the theft of their addresses and bank account numbers, but it is estimated the ...
1 year ago Cysecurity.news Meow
T-Mobile Data Breach Affects 37 Million Customers: What You Should Know - T-Mobile recently announced that a data breach of its API had impacted the personal records of over 37 million customers. The breach occurred on the T-Mobile website, and could have allowed unauthorized users to access customer data such as name, ...
2 years ago Heimdalsecurity.com
Ivanti discloses new zero-day flaw, releases delayed patches - Ivanti Wednesday released patches for two critical zero-day vulnerabilities that were disclosed earlier this month, but also warned customers of two new flaws, including a new zero-day that's under exploitation in the wild. In a security advisory on ...
1 year ago Techtarget.com CVE-2023-46805 CVE-2024-21887 CVE-2024-21888 CVE-2024-21893
CVE-2020-5356 - Dell PowerProtect Data Manager (PPDM) versions prior to 19.4 and Dell PowerProtect X400 versions prior to 3.2 contain an improper authorization vulnerability. A remote authenticated malicious user may download any file from the affected PowerProtect ...
4 years ago
Vulnerability Summary for the Week of March 4, 2024 - Published 2024-03-06 CVSS Score not yet calculated Source & Patch Info CVE-2023-52584416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 PrimaryVendor - ...
1 year ago Cisa.gov
Vulnerability Summary for the Week of March 11, 2024 - Published 2024-03-15 CVSS Score not yet calculated Source & Patch Info CVE-2021-47111416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 PrimaryVendor - Product linux - linux Description In the ...
1 year ago Cisa.gov
Simplify budgets and purchasing with Cisco Security Suites - In the pursuit of better security outcomes, organizations have relied on an ever-increasing number of products and services. On average, enterprise customers use as many as 76 unique security solutions. This complexity makes it very difficult for ...
1 year ago Feedpress.me
Accelerating Your Journey to the 128-bit Universe - The 2023 National Cybersecurity Strategy requires acceleration of your agency's mission to go boldly into the 128-bit address space universe with greater speed and urgency. IPv6-only is the addressing standard for the U.S. Federal Government, ...
1 year ago Feedpress.me
Cohesity partners with NVIDIA to harness the power of generative AI - Cohesity announced a collaboration with NVIDIA to help organizations safely unlock the power of generative AI and data using the recently announced NVIDIA NIM microservices and by integrating NVIDIA AI Enterprise into the Cohesity Gaia platform. ...
1 year ago Helpnetsecurity.com
Dell API Abused to Steal 49 Million Customer Records in Data Breach - The threat actor responsible for the recent Dell data breach stated that he scraped information from 49 million customer records via a partner portal API that he accessed as a phony organization. Dell had begun sending alerts to customers informing ...
1 year ago Cysecurity.news
FCC orders telecom carriers to report PII data breaches within 30 days - Starting March 13th, telecommunications companies must report data breaches impacting customers' personally identifiable information within 30 days, as required by FCC's updated data breach reporting requirements. FCC's final rule follows several ...
1 year ago Bleepingcomputer.com