CVE-2023-44284
Medium
Description
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an SQL Injection vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend database causing unauthorized read access to application data.
SeverityMedium
CVSS4.3
Exploit probability—
ProductDell Powerprotect Data Protection
PublishedDec 14, 2023
First seenDec 14, 2023
Weakness typeCWE-89SQL injection
How to fix
Update
- dell powerprotect_data_protection2.7.6 or later
- dell apex_protection_storage6.2.1.110, 7.10.1.15 or later
- dell powerprotect_data_domain6.2.1.110, 7.12.0.0 or later
- dell powerprotect_data_domain_management_center6.2.1.110, 7.13.0.10, 7.7.5.25, 7.10.1.15 or later
- dell emc_data_domain_os6.2.1.110, 7.12.0.0, 7.7.5.25, 7.10.1.15 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dell powerprotect_data_protection | v < 2.7.6 | 2.7.6 |
| dell apex_protection_storage | v < 6.2.1.110, 7.0 ≤ v < 7.10.1.15 | 6.2.1.110, 7.10.1.15 |
| dell powerprotect_data_domain | v < 6.2.1.110, 7.0 ≤ v < 7.12.0.0 | 6.2.1.110, 7.12.0.0 |
| dell powerprotect_data_domain_management_center | v < 6.2.1.110, 7.0 ≤ v < 7.13.0.10, 7.7 ≤ v < 7.7.5.25, 7.10 ≤ v < 7.10.1.15 | 6.2.1.110, 7.13.0.10, 7.7.5.25, 7.10.1.15 |
| dell emc_data_domain_os | v < 6.2.1.110, 7.0 ≤ v < 7.12.0.0, 7.7 ≤ v < 7.7.5.25, 7.10 ≤ v < 7.10.1.15 | 6.2.1.110, 7.12.0.0, 7.7.5.25, 7.10.1.15 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.