Lucene search

DellCVELIST:CVE-2022-46754

HistoryFeb 10, 2023 - 9:25 p.m.

CVE-2022-46754

2023-02-1021:25:19

CWE-284

dell

www.cve.org

wyse management suite

improper access control

vulnerability

authenticated user

admin user

pro license features

user controlled

external entities

CVSS3

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

29.1%

JSON

Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user might access certain pro license features for which this admin is not authorized in order to configure user controlled external entities.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Wyse Management Suite",
    "vendor": "Dell",
    "versions": [
      {
        "lessThanOrEqual": "3.8",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.dell.com/support/kbdoc/en-us/000206134/dsa-2022-329-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities

CVSS3

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

29.1%

JSON

Related for CVELIST:CVE-2022-46754