Vulnerability Details : CVE-2019-18581

Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server missing authorization vulnerability in the REST API. A remote authenticated malicious user with administrative privileges may potentially exploit this vulnerability to alter the application’s allowable list of OS commands. This may lead to arbitrary OS command execution as the regular user runs the DPA service on the affected system.
Published 2020-03-18 19:15:16
Updated 2020-03-24 19:10:59
Source Dell
View at NVD,   CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2019-18581

EPSS FAQ
0.23%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 60 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-18581

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
9.0
 HIGH AV:N/AC:L/Au:S/C:C/I:C/A:C
8.0
10.0
 NIST
9.1
 CRITICAL CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
2.3
6.0
 Dell
7.2
 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1.2
5.9
 NIST

CWE ids for CVE-2019-18581

  • The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
    Assigned by:
    • nvd@nist.gov (Primary)
    • security_alert@emc.com (Secondary)

References for CVE-2019-18581

Products affected by CVE-2019-18581

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close