Lucene search

DellCVE-2024-37131

HistoryJun 13, 2024 - 3:15 p.m.

CVE-2024-37131

2024-06-1315:15:52

CWE-942

dell

web.nvd.nist.gov

scg policy manager

cross-origin resource policy

vulnerability

remote attack

authentication

malicious actions

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

Low

EPSS

Percentile

9.0%

JSON

SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious actions on the application in the context of the authenticated user.

Affected configurations

Vulners

Vulnrichment

Node

dellsecure_connect_gateway_\(scg\)_policy_managerRange≤5.22.00.18

VendorProductVersionCPE
dellsecure_connect_gateway_\(scg\)_policy_manager*cpe:2.3:a:dell:secure_connect_gateway_\(scg\)_policy_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	secure_connect_gateway_\(scg\)_policy_manager	*	cpe:2.3:a:dell:secure_connect_gateway_\(scg\)_policy_manager::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Secure Connect Gateway (SCG) Policy Manager",
    "vendor": "Dell",
    "versions": [
      {
        "lessThanOrEqual": "5.22.00.18",
        "status": "affected",
        "version": "5.18.20",
        "versionType": "semver"
      }
    ]
  }
]

References

www.dell.com/support/kbdoc/en-us/000225956/dsa-2024-254-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-37131