CVE-2019-3749
Medium
Description
Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A local authenticated malicious user with low privileges potentially could exploit this vulnerability to delete arbitrary files by creating a symlink from the "Temp\ICProgress\Dell_InventoryCollector_Progress.xml" to any targeted file. This issue occurs because permissions on the Temp directory were set incorrectly.
SeverityMedium
CVSS5.5
Exploit probability—
ProductDell Command Update
PublishedDec 3, 2019
First seenDec 3, 2019
Weakness typeCWE-427CWE-427
How to fix
Update
- dell command_update3.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dell command_update | v < 3.1 | 3.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.