跳至主要內容
登出

歡迎來到 Dell

我的帳戶
  • 簡單快速地下訂單
  • 檢視訂單及追蹤商品運送狀態
  • 建立並存取您的產品清單
  • 使用「公司管理」來管理您的 Dell EMC 網站、產品和產品層級連絡人。
登入 建立帳戶 Premier 登入 合作夥伴計畫登入
與我們連絡

您的 Dell.com 購物車

文章編號: 000201258

DSA-2022-182: Cloud Mobility for Dell Storage Security Update for a Path Traversal RCE Vulnerability

摘要: Cloud Mobility for Dell Storage remediation is available for a path traversal RCE vulnerability that may be exploited by malicious users to compromise the affected system.

文章內容

影響

High

詳細資料

Cloud Mobility for Dell Storage 1.3.0 contains an RCE vulnerability. A nonprivileged user could potentially exploit this vulnerability, leading to achieving a root shell. This is a high severity issue; so Dell Technologies recommends customers to upgrade at the earliest opportunity.

Proprietary Code CVE Description CVSS Base Score CVSS Vector
CVE-2022-33936 Cloud Mobility for Dell Storage versions 1.3.0 and earlier contains a path traversal in the backup mechanism for the vApp. Any basic user may purposefully or accidentally exploit this vulnerability, leading to RCE with full take over of the system. 8.0 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H This hyperlink is taking you to a website outside of Dell Technologies.

 

Cloud Mobility for Dell Storage 1.3.0 contains an RCE vulnerability. A nonprivileged user could potentially exploit this vulnerability, leading to achieving a root shell. This is a high severity issue; so Dell Technologies recommends customers to upgrade at the earliest opportunity.

Proprietary Code CVE Description CVSS Base Score CVSS Vector
CVE-2022-33936 Cloud Mobility for Dell Storage versions 1.3.0 and earlier contains a path traversal in the backup mechanism for the vApp. Any basic user may purposefully or accidentally exploit this vulnerability, leading to RCE with full take over of the system. 8.0 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H This hyperlink is taking you to a website outside of Dell Technologies.

 

Dell Technologies 建議所有客戶不僅要參考 CVSS 基本分數，也要將可能會影響與特定安全漏洞相關之潛在嚴重性的所有相關暫時和環境分數納入考量。

受影響的產品與補救措施

 
CVE Addressed  Product Affected Version Updated Version Link to Update
CVE-2022-33936 Cloud Mobility for Dell Storage 1.3.0 1.3.1 Amazon Marketplace: Cloud Mobility for Dell Storage This hyperlink is taking you to a website outside of Dell Technologies.
Or
VMware Marketplace This hyperlink is taking you to a website outside of Dell Technologies.
 
CVE Addressed  Product Affected Version Updated Version Link to Update
CVE-2022-33936 Cloud Mobility for Dell Storage 1.3.0 1.3.1 Amazon Marketplace: Cloud Mobility for Dell Storage This hyperlink is taking you to a website outside of Dell Technologies.
Or
VMware Marketplace This hyperlink is taking you to a website outside of Dell Technologies.

解決方式與緩解措施

We now reject any patterns in the restore tar file that start with an absolute path or contain .. anywhere in the file path.

修訂歷史記錄

RevisionDateDescription
1.02022-07-06Initial release 

相關資訊

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

法律資訊

文章屬性

受影響的產品

Product Security Information

上次發佈日期

20 6月 2023

文章類型

Dell Security Advisory

返回頁首