Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Enjoy members-only rewards and discounts
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.
Sign In Create an Account Dell Financial Services Premier Sign In Partner Program Sign In
Contact Us

Your Dell.com Carts

Article Number: 000225956

DSA-2024-254: Security Update for Dell Secure Connect Gateway Policy Manager Multiple Vulnerabilities

Summary: Dell Secure Connect Gateway Policy Manager remediation for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.

Article Content

Impact

Critical

Details

Third-Party Component  

 

CVEs 

More information 

org.postgresql:postgresql

CVE-2024-1597

See NVD link below for individual scores for each CVE.
https://nvd.nist.gov/This hyperlink is taking you to a website outside of Dell Technologies.

org.bouncycastle

CVE-2023-33202, CVE-2024-30172

See NVD link below for individual scores for each CVE.
https://nvd.nist.gov/This hyperlink is taking you to a website outside of Dell Technologies.

ip

CVE-2023-42282

See NVD link below for individual scores for each CVE.
https://nvd.nist.gov/This hyperlink is taking you to a website outside of Dell Technologies.

luxon

CVE-2023-22467

See NVD link below for individual scores for each CVE.
https://nvd.nist.gov/This hyperlink is taking you to a website outside of Dell Technologies.

minimatch

CVE-2022-3517

See NVD link below for individual scores for each CVE.
https://nvd.nist.gov/This hyperlink is taking you to a website outside of Dell Technologies.

json5

CVE-2022-46175

See NVD link below for individual scores for each CVE.
https://nvd.nist.gov/This hyperlink is taking you to a website outside of Dell Technologies.

http-cache-semantics

CVE-2022-25881

See NVD link below for individual scores for each CVE.
https://nvd.nist.gov/This hyperlink is taking you to a website outside of Dell Technologies.

Java

CVE-2024-20918, CVE-2024-20919, CVE-2024-20921, CVE-2024-20923, CVE-2024-20926, CVE-2024-20932

See NVD link below for individual scores for each CVE.
https://nvd.nist.gov/This hyperlink is taking you to a website outside of Dell Technologies.

Spring Framework

CVE-2024-22234, CVE-2024-22243, CVE-2024-22257, CVE-2024-22259, CVE-2024-22262

See NVD link below for individual scores for each CVE.
https://nvd.nist.gov/This hyperlink is taking you to a website outside of Dell Technologies.

SUSE Enterprise 12 SP5

CVE-2021-46932, CVE-2022-20154, CVE-2023-35827, CVE-2023-52340, CVE-2023-52429, CVE-2023-52482, CVE-2023-52502, CVE-2023-52597, CVE-2024-0340, CVE-2024-0607, CVE-2024-0775, CVE-2024-1086, CVE-2024-1151, CVE-2024-23849, CVE-2024-23851, CVE-2024-26585, CVE-2024-26595, CVE-2024-26600, CVE-2024-26622, CVE-2023-51385

See NVD link below for individual scores for each CVE.
https://nvd.nist.gov/This hyperlink is taking you to a website outside of Dell Technologies.

Proprietary Code CVEs   

Description   

CVSSBase Score   

CVSS Vector String    

CVE-2024-37131

SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious actions on the application in the context of the authenticated user.

7.5

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
This hyperlink is taking you to a website outside of Dell Technologies.

Proprietary Code CVEs   

Description   

CVSSBase Score   

CVSS Vector String    

CVE-2024-37131

SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious actions on the application in the context of the authenticated user.

7.5

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
This hyperlink is taking you to a website outside of Dell Technologies.
Dell Technologies recommends all customers consider both the CVSS base score and any relevant temporal and environmental scores that may impact the potential severity associated with a particular security vulnerability.

Affected Products and Remediation

CVEs Addressed

Product

Affected Versions

Updated Version

Link to Update

CVE-2024-1597, CVE-2023-33202, CVE-2024-30172, CVE-2024-20918, CVE-2024-20919, CVE-2024-20921, CVE-2024-20923, CVE-2024-20926, CVE-2024-20932, CVE-2024-22234, CVE-2024-22243, CVE-2024-22257, CVE-2024-22259, CVE-2024-22262, CVE-2021-46932, CVE-2022-20154, CVE-2023-35827, CVE-2023-52429, CVE-2023-52482, CVE-2023-52502, CVE-2023-52597, CVE-2024-0340, CVE-2024-0607, CVE-2024-0775, CVE-2024-1086, CVE-2024-1151, CVE-2024-23849, CVE-2024-23851, CVE-2024-26585, CVE-2024-26595, CVE-2024-26600, CVE-2024-26622, CVE-2023-51385, CVE-2023-52340

Dell Policy Manager for Secure Connect Gateway

Version 5.22.00.18

Version 5.24.00.14 or later

https://www.dell.com/support/home/product-support/product/secure-connect-gateway-ve/drivers

CVE-2023-42282, CVE-2023-22467, CVE-2022-3517, CVE-2022-46175, CVE-2022-25881, CVE-2024-37131

Dell Policy Manager for Secure Connect Gateway

 

Versions 5.18.20 through 5.22.00.18

Version 5.24.00.14 or later

https://www.dell.com/support/home/product-support/product/secure-connect-gateway-ve/drivers

CVEs Addressed

Product

Affected Versions

Updated Version

Link to Update

CVE-2024-1597, CVE-2023-33202, CVE-2024-30172, CVE-2024-20918, CVE-2024-20919, CVE-2024-20921, CVE-2024-20923, CVE-2024-20926, CVE-2024-20932, CVE-2024-22234, CVE-2024-22243, CVE-2024-22257, CVE-2024-22259, CVE-2024-22262, CVE-2021-46932, CVE-2022-20154, CVE-2023-35827, CVE-2023-52429, CVE-2023-52482, CVE-2023-52502, CVE-2023-52597, CVE-2024-0340, CVE-2024-0607, CVE-2024-0775, CVE-2024-1086, CVE-2024-1151, CVE-2024-23849, CVE-2024-23851, CVE-2024-26585, CVE-2024-26595, CVE-2024-26600, CVE-2024-26622, CVE-2023-51385, CVE-2023-52340

Dell Policy Manager for Secure Connect Gateway

Version 5.22.00.18

Version 5.24.00.14 or later

https://www.dell.com/support/home/product-support/product/secure-connect-gateway-ve/drivers

CVE-2023-42282, CVE-2023-22467, CVE-2022-3517, CVE-2022-46175, CVE-2022-25881, CVE-2024-37131

Dell Policy Manager for Secure Connect Gateway

 

Versions 5.18.20 through 5.22.00.18

Version 5.24.00.14 or later

https://www.dell.com/support/home/product-support/product/secure-connect-gateway-ve/drivers

Workarounds and Mitigations

None

Revision History

RevisionDateDescription
1.02024-06-11Initial Release
2.02024-06-12Updated table links
3.02024-06-13Updated the format for the table

Related Information

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

Legal Information

Article Properties

Last Published Date

13 Jun 2024

Article Type

Dell Security Advisory

Back to Top