CVE Vulnerability

CVE-2019-3746

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote user may exploit this vulnerability to launch a brute-force authentication attack in order to gain access to the system.

6.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.dell.com/support/security/en-us/details/536363/DSA-2019-112-Dell-EMC-Integrated-Data-Protection-Appliance-Multiple-Vulnerabilities Vendor Advisory
Configurations

Configuration 1
Information

Published : 2019-09-27 09:15

Updated : 2019-10-09 11:49

NVD link : CVE-2019-3746

Mitre link : CVE-2019-3746

Products Affected

Dell

Emc Idpa Dp4400

Emc Idpa Dp5800

Emc Idpa Dp8300

Emc Idpa Dp8800

Emc Integrated Data Protection Appliance Firmware

CWE
CWE-307

Improper Restriction of Excessive Authentication Attempts