Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.
Sign In Create an Account Premier Sign In Partner Program Sign In
Contact Us

Your Dell.com Carts

Some article numbers may have changed. If this isn't what you're looking for, try searching all articles. Search articles

Article Number: 000201395

DSA-2022-153: Dell ECS Security Update for an IAM Vulnerability

Summary: Dell ECS remediation is available for an IAM security vulnerability that may be exploited by malicious users to compromise the affected system.

Article Content

Impact

Medium

Details

Proprietary Code Description CVSS Base Score CVSS Vector String
CVE-2022-31231 Dell ECS, versions 3.5 and 3.6, contain an Improper Access Control in the Identity and Access Management (IAM) module. A remote unauthenticated attacker may potentially exploit this vulnerability, leading to gaining read access to unauthorized data. 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N This hyperlink is taking you to a website outside of Dell Technologies.
Proprietary Code Description CVSS Base Score CVSS Vector String
CVE-2022-31231 Dell ECS, versions 3.5 and 3.6, contain an Improper Access Control in the Identity and Access Management (IAM) module. A remote unauthenticated attacker may potentially exploit this vulnerability, leading to gaining read access to unauthorized data. 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N This hyperlink is taking you to a website outside of Dell Technologies.
Dell Technologies recommends all customers consider both the CVSS base score and any relevant temporal and environmental scores that may impact the potential severity associated with a particular security vulnerability.

Affected Products and Remediation

Product Affected Versions Updated Versions Link to Update
Dell ECS Version 3.5.x.x before 3.5.1.7
Version 3.6.x.x. before 3.6.2.4
  • 3.5.1.7
  • 3.6.2.4
  • Manual Patch for affected versions
 See Dell article 200962, ECS: Solution to address CVE-2022-31231 security vulnerability on 3.5.x/3.6.x to Apply Patch.

Dell Technologies recommends all customers update their ECS systems at the earliest opportunity following the 'Apply Patch' link.

Customers apply the patch in order to quickly and safely avoid prolonged exposure to this vulnerability.
Product Affected Versions Updated Versions Link to Update
Dell ECS Version 3.5.x.x before 3.5.1.7
Version 3.6.x.x. before 3.6.2.4
  • 3.5.1.7
  • 3.6.2.4
  • Manual Patch for affected versions
 See Dell article 200962, ECS: Solution to address CVE-2022-31231 security vulnerability on 3.5.x/3.6.x to Apply Patch.

Dell Technologies recommends all customers update their ECS systems at the earliest opportunity following the 'Apply Patch' link.

Customers apply the patch in order to quickly and safely avoid prolonged exposure to this vulnerability.
Q: What if I must upgrade to one of the affected versions after applying the patch?
A: Customers should upgrade to an ECS version that has the fix. If this is not possible, customers must reapply the patch after the upgrade if the upgrade is to an affected version.

Q: My ECS version is not listed in the Affected Version column. What is the status of my ECS code?
A: If your ECS version is not listed under the Affected Version column, this denotes that this issue does not impact your ECS version, and no updating is required. Note: It is recommended to upgrade to the latest or target code.

Q: What if I am only using legacy users and not IAM?
A: Customers must apply the patch even if they are using the legacy users and not using IAM.

Workarounds and Mitigations

None

Revision History

RevisionDateDescription
1.02022-07-11Initial Release

Related Information

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

Legal Information

Article Properties

Affected Product
ECS, ECS Appliance Hardware Gen3 EX5000, ECS Appliance, ECS Appliance Gen 3, ECS Appliance Hardware Gen3 EX300, ECS Appliance Hardware Gen3 EX3000, ECS Appliance Hardware Gen2 C-Series, ECS Appliance Hardware Gen2 D-Series , ECS Appliance Hardware Gen2 U-Series, ECS Appliance Hardware Gen3 EX500, ECS Appliance Hardware Gen3 EXF900, ECS Appliance Hardware Series, ECS Appliance Software with Encryption, ECS Appliance Software without Encryption, ECS SD, Product Security Information ...
Last Published Date

14 Jun 2023

Article Type

Dell Security Advisory

Back to Top