Lucene search

[email protected]NVD:CVE-2022-32481

HistoryJul 07, 2022 - 10:15 p.m.

CVE-2022-32481

2022-07-0722:15:08

[email protected]

web.nvd.nist.gov

dell powerprotect cyber recovery

privilege escalation

virtual appliance deployments

docker commands

root privileges

system takeover

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

12.6%

JSON

Dell PowerProtect Cyber Recovery, versions prior to 19.11, contain a privilege escalation vulnerability on virtual appliance deployments. A lower-privileged authenticated user can chain docker commands to escalate privileges to root leading to complete system takeover.

Affected configurations

Nvd

Node

dellpowerprotect_cyber_recoveryRange<19.11

VendorProductVersionCPE
dellpowerprotect_cyber_recovery*cpe:2.3:a:dell:powerprotect_cyber_recovery:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	powerprotect_cyber_recovery	*	cpe:2.3:a:dell:powerprotect_cyber_recovery::::::::

References

support.emc.com/kb/000201213

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

12.6%

JSON

Related for NVD:CVE-2022-32481

nessus1 prion1 cvelist1 cve1