Lucene search

[email protected]CVE-2018-15766

HistoryOct 11, 2018 - 7:29 p.m.

CVE-2018-15766

2018-10-1119:29:00

CWE-521

[email protected]

web.nvd.nist.gov

dell

encryption

endpoint security

password policy

vulnerability

installation

cve-2018-15766

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.6 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

33.9%

JSON

On install, Dell Encryption versions prior 10.0.1 and Dell Endpoint Security Suite Enterprise versions prior 2.0.1 will overwrite and manually set the “Minimum Password Length” group policy object to a value of 1 on that device. This allows for users to bypass any existing policy for password length and potentially create insecure password on their device. This value is defined during the installation of the “Encryption Management Agent” or “EMAgent” application. There are no other known values modified.

Affected configurations

NVD

Node

dellencryptionRange<10.0.1

dellendpoint_security_suite_enterpriseRange<2.0.1

CPENameOperatorVersion
dell:encryptiondell encryptionlt10.0.1
dell:endpoint_security_suite_enterprisedell endpoint security suite enterpriselt2.0.1

CPE	Name	Operator	Version
dell:encryption	dell encryption	lt	10.0.1
dell:endpoint_security_suite_enterprise	dell endpoint security suite enterprise	lt	2.0.1

CNA Affected

[
  {
    "product": "Encryption",
    "vendor": "Dell",
    "versions": [
      {
        "lessThan": "10.0.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Endpoint Security Suite Enterprise ",
    "vendor": "Dell",
    "versions": [
      {
        "lessThan": "2.0.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.dell.com/support/article/us/en/04/sln313561/dell-encryption-and-dell-endpoint-security-suite-enterprise-security-policy-overwrite-vulnerability?lang=en

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.6 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

33.9%

JSON

Related for CVE-2018-15766

prion1 cvelist1 nvd1