CVE-2023-44285
High
Description
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an improper access control vulnerability. A local malicious user with low privileges could potentially exploit this vulnerability leading to escalation of privilege.
SeverityHigh
CVSS7.8
Exploit probability—
ProductDell Powerprotect Data Protection
PublishedDec 14, 2023
First seenDec 14, 2023
Weakness typeCWE-1220CWE-1220
How to fix
Update
- dell powerprotect_data_protection2.7.6 or later
- dell apex_protection_storage6.2.1.110, 7.10.1.15 or later
- dell powerprotect_data_domain6.2.1.110, 7.12.0.0 or later
- dell powerprotect_data_domain_management_center6.2.1.110, 7.13.0.10, 7.7.5.25, 7.10.1.15 or later
- dell emc_data_domain_os6.2.1.110, 7.12.0.0, 7.7.5.25, 7.10.1.15 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dell powerprotect_data_protection | v < 2.7.6 | 2.7.6 |
| dell apex_protection_storage | v < 6.2.1.110, 7.0 ≤ v < 7.10.1.15 | 6.2.1.110, 7.10.1.15 |
| dell powerprotect_data_domain | v < 6.2.1.110, 7.0 ≤ v < 7.12.0.0 | 6.2.1.110, 7.12.0.0 |
| dell powerprotect_data_domain_management_center | v < 6.2.1.110, 7.0 ≤ v < 7.13.0.10, 7.7 ≤ v < 7.7.5.25, 7.10 ≤ v < 7.10.1.15 | 6.2.1.110, 7.13.0.10, 7.7.5.25, 7.10.1.15 |
| dell emc_data_domain_os | v < 6.2.1.110, 7.0 ≤ v < 7.12.0.0, 7.7 ≤ v < 7.7.5.25, 7.10 ≤ v < 7.10.1.15 | 6.2.1.110, 7.12.0.0, 7.7.5.25, 7.10.1.15 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.