admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-08-04 08:44:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

"-Synchronized-Data."

Browse Source
This commit is contained in:
CVE Team 2021-09-28 20:01:00 +00:00
parent b012b93b5c
commit 9d45bb74e5
No known key found for this signature in database
GPG Key ID: 5708902F06FEF743
9 changed files with 182 additions and 169 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
2012/0xxx/CVE-2012-0881.json
View File

@ -101,6 +101,11 @@
"url": "https://www.oracle.com//security-alerts/cpujul2021.html", "url": "https://www.oracle.com//security-alerts/cpujul2021.html",
"refsource": "MISC", "refsource": "MISC",
"name": "https://www.oracle.com//security-alerts/cpujul2021.html" "name": "https://www.oracle.com//security-alerts/cpujul2021.html"
},
{
"refsource": "MLIST",
"name": "[hadoop-common-issues] 20210928 [GitHub] [hadoop] warrenzhu25 opened a new pull request #3496: HADOOP-17941. Update xerces to 2.12",
"url": "https://lists.apache.org/thread.html/rea7b831dceeb2a2fa817be6f63b08722042e3647fb2d47c144370a56@%3Ccommon-issues.hadoop.apache.org%3E"
} }
] ]
} }

43
2021/21xxx/CVE-2021-21522.json
View File

@ -1,10 +1,10 @@
{ {
"CVE_data_meta": { "CVE_data_meta": {
"ASSIGNER": "secure@dell.com", "ASSIGNER": "secure@dell.com",
"DATE_PUBLIC": "2021-09-16", "DATE_PUBLIC": "2021-09-16",
"ID": "CVE-2021-21522", "ID": "CVE-2021-21522",
"STATE": "PUBLIC" "STATE": "PUBLIC"
}, },
"affects": { "affects": {
"vendor": { "vendor": {
"vendor_data": [ "vendor_data": [
@ -12,59 +12,60 @@
"product": { "product": {
"product_data": [ "product_data": [
{ {
"product_name": "CPG BIOS", "product_name": "CPG BIOS",
"version": { "version": {
"version_data": [ "version_data": [
{ {
"version_affected": "<", "version_affected": "<",
"version_value": "1.13.0" "version_value": "1.13.0"
} }
] ]
} }
} }
] ]
}, },
"vendor_name": "Dell" "vendor_name": "Dell"
} }
] ]
} }
}, },
"data_format": "MITRE", "data_format": "MITRE",
"data_type": "CVE", "data_type": "CVE",
"data_version": "4.0", "data_version": "4.0",
"description": { "description": {
"description_data": [ "description_data": [
{ {
"lang": "eng", "lang": "eng",
"value": "Dell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vulnerability to gain access to sensitive information on an NVMe storage by resetting the BIOS password on the system via the Manageability Interface." "value": "Dell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vulnerability to gain access to sensitive information on an NVMe storage by resetting the BIOS password on the system via the Manageability Interface."
} }
] ]
}, },
"impact": { "impact": {
"cvss": { "cvss": {
"baseScore": 8.2, "baseScore": 8.2,
"baseSeverity": "High", "baseSeverity": "High",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1" "version": "3.1"
} }
}, },
"problemtype": { "problemtype": {
"problemtype_data": [ "problemtype_data": [
{ {
"description": [ "description": [
{ {
"lang": "eng", "lang": "eng",
"value": "CWE-255: Credentials Management" "value": "CWE-255: Credentials Management"
} }
] ]
} }
] ]
}, },
"references": { "references": {
"reference_data": [ "reference_data": [
{ {
"refsource": "CONFIRM", "refsource": "MISC",
"url": "https://www.dell.com/support/kbdoc/000191495" "url": "https://www.dell.com/support/kbdoc/000191495",
"name": "https://www.dell.com/support/kbdoc/000191495"
} }
] ]
} }

43
2021/21xxx/CVE-2021-21569.json
View File

@ -1,10 +1,10 @@
{ {
"CVE_data_meta": { "CVE_data_meta": {
"ASSIGNER": "secure@dell.com", "ASSIGNER": "secure@dell.com",
"DATE_PUBLIC": "2021-09-02", "DATE_PUBLIC": "2021-09-02",
"ID": "CVE-2021-21569", "ID": "CVE-2021-21569",
"STATE": "PUBLIC" "STATE": "PUBLIC"
}, },
"affects": { "affects": {
"vendor": { "vendor": {
"vendor_data": [ "vendor_data": [
@ -12,59 +12,60 @@
"product": { "product": {
"product_data": [ "product_data": [
{ {
"product_name": "NetWorker", "product_name": "NetWorker",
"version": { "version": {
"version_data": [ "version_data": [
{ {
"version_affected": "=", "version_affected": "=",
"version_value": "18.x, 19.x" "version_value": "18.x, 19.x"
} }
] ]
} }
} }
] ]
}, },
"vendor_name": "Dell" "vendor_name": "Dell"
} }
] ]
} }
}, },
"data_format": "MITRE", "data_format": "MITRE",
"data_type": "CVE", "data_type": "CVE",
"data_version": "4.0", "data_version": "4.0",
"description": { "description": {
"description_data": [ "description_data": [
{ {
"lang": "eng", "lang": "eng",
"value": "Dell NetWorker, versions 18.x and 19.x contain a Path traversal vulnerability. A NetWorker server user with remote access to NetWorker clients may potentially exploit this vulnerability and gain access to unauthorized information." "value": "Dell NetWorker, versions 18.x and 19.x contain a Path traversal vulnerability. A NetWorker server user with remote access to NetWorker clients may potentially exploit this vulnerability and gain access to unauthorized information."
} }
] ]
}, },
"impact": { "impact": {
"cvss": { "cvss": {
"baseScore": 6.8, "baseScore": 6.8,
"baseSeverity": "Medium", "baseSeverity": "Medium",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1" "version": "3.1"
} }
}, },
"problemtype": { "problemtype": {
"problemtype_data": [ "problemtype_data": [
{ {
"description": [ "description": [
{ {
"lang": "eng", "lang": "eng",
"value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
} }
] ]
} }
] ]
}, },
"references": { "references": {
"reference_data": [ "reference_data": [
{ {
"refsource": "CONFIRM", "refsource": "MISC",
"url": "https://www.dell.com/support/kbdoc/en-us/000188311/" "url": "https://www.dell.com/support/kbdoc/en-us/000188311/",
"name": "https://www.dell.com/support/kbdoc/en-us/000188311/"
} }
] ]
} }

43
2021/21xxx/CVE-2021-21570.json
View File

@ -1,10 +1,10 @@
{ {
"CVE_data_meta": { "CVE_data_meta": {
"ASSIGNER": "secure@dell.com", "ASSIGNER": "secure@dell.com",
"DATE_PUBLIC": "2021-09-02", "DATE_PUBLIC": "2021-09-02",
"ID": "CVE-2021-21570", "ID": "CVE-2021-21570",
"STATE": "PUBLIC" "STATE": "PUBLIC"
}, },
"affects": { "affects": {
"vendor": { "vendor": {
"vendor_data": [ "vendor_data": [
@ -12,59 +12,60 @@
"product": { "product": {
"product_data": [ "product_data": [
{ {
"product_name": "NetWorker", "product_name": "NetWorker",
"version": { "version": {
"version_data": [ "version_data": [
{ {
"version_affected": "=", "version_affected": "=",
"version_value": "18.x, 19.x" "version_value": "18.x, 19.x"
} }
] ]
} }
} }
] ]
}, },
"vendor_name": "Dell" "vendor_name": "Dell"
} }
] ]
} }
}, },
"data_format": "MITRE", "data_format": "MITRE",
"data_type": "CVE", "data_type": "CVE",
"data_version": "4.0", "data_version": "4.0",
"description": { "description": {
"description_data": [ "description_data": [
{ {
"lang": "eng", "lang": "eng",
"value": "Dell NetWorker, versions 18.x and 19.x contain an Information disclosure vulnerability. A NetWorker server user with remote access to NetWorker clients may potentially exploit this vulnerability and gain access to unauthorized information." "value": "Dell NetWorker, versions 18.x and 19.x contain an Information disclosure vulnerability. A NetWorker server user with remote access to NetWorker clients may potentially exploit this vulnerability and gain access to unauthorized information."
} }
] ]
}, },
"impact": { "impact": {
"cvss": { "cvss": {
"baseScore": 6.8, "baseScore": 6.8,
"baseSeverity": "Medium", "baseSeverity": "Medium",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1" "version": "3.1"
} }
}, },
"problemtype": { "problemtype": {
"problemtype_data": [ "problemtype_data": [
{ {
"description": [ "description": [
{ {
"lang": "eng", "lang": "eng",
"value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
} }
] ]
} }
] ]
}, },
"references": { "references": {
"reference_data": [ "reference_data": [
{ {
"refsource": "CONFIRM", "refsource": "MISC",
"url": "https://www.dell.com/support/kbdoc/en-us/000188311/dsa-2021-124-dell-networker-security-update-for-multiple-vulnerabilities" "url": "https://www.dell.com/support/kbdoc/en-us/000188311/dsa-2021-124-dell-networker-security-update-for-multiple-vulnerabilities",
"name": "https://www.dell.com/support/kbdoc/en-us/000188311/dsa-2021-124-dell-networker-security-update-for-multiple-vulnerabilities"
} }
] ]
} }

43
2021/36xxx/CVE-2021-36283.json
View File

@ -1,10 +1,10 @@
{ {
"CVE_data_meta": { "CVE_data_meta": {
"ASSIGNER": "secure@dell.com", "ASSIGNER": "secure@dell.com",
"DATE_PUBLIC": "2021-09-16", "DATE_PUBLIC": "2021-09-16",
"ID": "CVE-2021-36283", "ID": "CVE-2021-36283",
"STATE": "PUBLIC" "STATE": "PUBLIC"
}, },
"affects": { "affects": {
"vendor": { "vendor": {
"vendor_data": [ "vendor_data": [
@ -12,59 +12,60 @@
"product": { "product": {
"product_data": [ "product_data": [
{ {
"product_name": "CPG BIOS", "product_name": "CPG BIOS",
"version": { "version": {
"version_data": [ "version_data": [
{ {
"version_affected": "<", "version_affected": "<",
"version_value": "1.3.1" "version_value": "1.3.1"
} }
] ]
} }
} }
] ]
}, },
"vendor_name": "Dell" "vendor_name": "Dell"
} }
] ]
} }
}, },
"data_format": "MITRE", "data_format": "MITRE",
"data_type": "CVE", "data_type": "CVE",
"data_version": "4.0", "data_version": "4.0",
"description": { "description": {
"description_data": [ "description_data": [
{ {
"lang": "eng", "lang": "eng",
"value": "Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM." "value": "Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM."
} }
] ]
}, },
"impact": { "impact": {
"cvss": { "cvss": {
"baseScore": 7.5, "baseScore": 7.5,
"baseSeverity": "High", "baseSeverity": "High",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1" "version": "3.1"
} }
}, },
"problemtype": { "problemtype": {
"problemtype_data": [ "problemtype_data": [
{ {
"description": [ "description": [
{ {
"lang": "eng", "lang": "eng",
"value": "CWE-20: Improper Input Validation" "value": "CWE-20: Improper Input Validation"
} }
] ]
} }
] ]
}, },
"references": { "references": {
"reference_data": [ "reference_data": [
{ {
"refsource": "CONFIRM", "refsource": "MISC",
"url": "https://www.dell.com/support/kbdoc/000191495/" "url": "https://www.dell.com/support/kbdoc/000191495/",
"name": "https://www.dell.com/support/kbdoc/000191495/"
} }
] ]
} }

43
2021/36xxx/CVE-2021-36284.json
View File

@ -1,10 +1,10 @@
{ {
"CVE_data_meta": { "CVE_data_meta": {
"ASSIGNER": "secure@dell.com", "ASSIGNER": "secure@dell.com",
"DATE_PUBLIC": "2021-09-16", "DATE_PUBLIC": "2021-09-16",
"ID": "CVE-2021-36284", "ID": "CVE-2021-36284",
"STATE": "PUBLIC" "STATE": "PUBLIC"
}, },
"affects": { "affects": {
"vendor": { "vendor": {
"vendor_data": [ "vendor_data": [
@ -12,59 +12,60 @@
"product": { "product": {
"product_data": [ "product_data": [
{ {
"product_name": "CPG BIOS", "product_name": "CPG BIOS",
"version": { "version": {
"version_data": [ "version_data": [
{ {
"version_affected": "<", "version_affected": "<",
"version_value": "1.7.0" "version_value": "1.7.0"
} }
] ]
} }
} }
] ]
}, },
"vendor_name": "Dell" "vendor_name": "Dell"
} }
] ]
} }
}, },
"data_format": "MITRE", "data_format": "MITRE",
"data_type": "CVE", "data_type": "CVE",
"data_version": "4.0", "data_version": "4.0",
"description": { "description": {
"description_data": [ "description_data": [
{ {
"lang": "eng", "lang": "eng",
"value": "Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive admin password attempt mitigations in order to carry out a brute force attack." "value": "Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive admin password attempt mitigations in order to carry out a brute force attack."
} }
] ]
}, },
"impact": { "impact": {
"cvss": { "cvss": {
"baseScore": 5.7, "baseScore": 5.7,
"baseSeverity": "Medium", "baseSeverity": "Medium",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1" "version": "3.1"
} }
}, },
"problemtype": { "problemtype": {
"problemtype_data": [ "problemtype_data": [
{ {
"description": [ "description": [
{ {
"lang": "eng", "lang": "eng",
"value": "CWE-307: Improper Restriction of Excessive Authentication Attempts" "value": "CWE-307: Improper Restriction of Excessive Authentication Attempts"
} }
] ]
} }
] ]
}, },
"references": { "references": {
"reference_data": [ "reference_data": [
{ {
"refsource": "CONFIRM", "refsource": "MISC",
"url": "https://www.dell.com/support/kbdoc/000191495" "url": "https://www.dell.com/support/kbdoc/000191495",
"name": "https://www.dell.com/support/kbdoc/000191495"
} }
] ]
} }

43
2021/36xxx/CVE-2021-36285.json
View File

@ -1,10 +1,10 @@
{ {
"CVE_data_meta": { "CVE_data_meta": {
"ASSIGNER": "secure@dell.com", "ASSIGNER": "secure@dell.com",
"DATE_PUBLIC": "2021-09-16", "DATE_PUBLIC": "2021-09-16",
"ID": "CVE-2021-36285", "ID": "CVE-2021-36285",
"STATE": "PUBLIC" "STATE": "PUBLIC"
}, },
"affects": { "affects": {
"vendor": { "vendor": {
"vendor_data": [ "vendor_data": [
@ -12,59 +12,60 @@
"product": { "product": {
"product_data": [ "product_data": [
{ {
"product_name": "CPG BIOS", "product_name": "CPG BIOS",
"version": { "version": {
"version_data": [ "version_data": [
{ {
"version_affected": "<", "version_affected": "<",
"version_value": "1.7.0" "version_value": "1.7.0"
} }
] ]
} }
} }
] ]
}, },
"vendor_name": "Dell" "vendor_name": "Dell"
} }
] ]
} }
}, },
"data_format": "MITRE", "data_format": "MITRE",
"data_type": "CVE", "data_type": "CVE",
"data_version": "4.0", "data_version": "4.0",
"description": { "description": {
"description_data": [ "description_data": [
{ {
"lang": "eng", "lang": "eng",
"value": "Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive NVMe password attempt mitigations in order to carry out a brute force attack." "value": "Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive NVMe password attempt mitigations in order to carry out a brute force attack."
} }
] ]
}, },
"impact": { "impact": {
"cvss": { "cvss": {
"baseScore": 5.7, "baseScore": 5.7,
"baseSeverity": "Medium", "baseSeverity": "Medium",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1" "version": "3.1"
} }
}, },
"problemtype": { "problemtype": {
"problemtype_data": [ "problemtype_data": [
{ {
"description": [ "description": [
{ {
"lang": "eng", "lang": "eng",
"value": "CWE-307: Improper Restriction of Excessive Authentication Attempts" "value": "CWE-307: Improper Restriction of Excessive Authentication Attempts"
} }
] ]
} }
] ]
}, },
"references": { "references": {
"reference_data": [ "reference_data": [
{ {
"refsource": "CONFIRM", "refsource": "MISC",
"url": "https://www.dell.com/support/kbdoc/000191495/" "url": "https://www.dell.com/support/kbdoc/000191495/",
"name": "https://www.dell.com/support/kbdoc/000191495/"
} }
] ]
} }

45
2021/36xxx/CVE-2021-36286.json
View File

@ -1,10 +1,10 @@
{ {
"CVE_data_meta": { "CVE_data_meta": {
"ASSIGNER": "secure@dell.com", "ASSIGNER": "secure@dell.com",
"DATE_PUBLIC": "2021-08-31", "DATE_PUBLIC": "2021-08-31",
"ID": "CVE-2021-36286", "ID": "CVE-2021-36286",
"STATE": "PUBLIC" "STATE": "PUBLIC"
}, },
"affects": { "affects": {
"vendor": { "vendor": {
"vendor_data": [ "vendor_data": [
@ -12,59 +12,60 @@
"product": { "product": {
"product_data": [ "product_data": [
{ {
"product_name": "SupportAssist Client Consumer", "product_name": "SupportAssist Client Consumer",
"version": { "version": {
"version_data": [ "version_data": [
{ {
"version_affected": "<=", "version_affected": "<=",
"version_value": "3.9.13.0 " "version_value": "3.9.13.0 "
} }
] ]
} }
} }
] ]
}, },
"vendor_name": "Dell" "vendor_name": "Dell"
} }
] ]
} }
}, },
"data_format": "MITRE", "data_format": "MITRE",
"data_type": "CVE", "data_type": "CVE",
"data_version": "4.0", "data_version": "4.0",
"description": { "description": {
"description_data": [ "description_data": [
{ {
"lang": "eng", "lang": "eng",
"value": "Dell SupportAssist Client Consumer versions 3.9.13.0 and any versions prior to 3.9.13.0 contain an arbitrary file deletion vulnerability that can be exploited by using the Windows feature of NTFS called Symbolic links. Symbolic links can be created by any(non-privileged) user under some object directories, but by themselves are not sufficient to successfully escalate privileges. However, combining them with a different object, such as the NTFS junction point allows for the exploitation. Support assist clean files functionality do not distinguish junction points from the physical folder and proceeds to clean the target of the junction that allows nonprivileged users to create junction points and delete arbitrary files on the system which can be accessed only by the admin. " "value": "Dell SupportAssist Client Consumer versions 3.9.13.0 and any versions prior to 3.9.13.0 contain an arbitrary file deletion vulnerability that can be exploited by using the Windows feature of NTFS called Symbolic links. Symbolic links can be created by any(non-privileged) user under some object directories, but by themselves are not sufficient to successfully escalate privileges. However, combining them with a different object, such as the NTFS junction point allows for the exploitation. Support assist clean files functionality do not distinguish junction points from the physical folder and proceeds to clean the target of the junction that allows nonprivileged users to create junction points and delete arbitrary files on the system which can be accessed only by the admin."
} }
] ]
}, },
"impact": { "impact": {
"cvss": { "cvss": {
"baseScore": 7.1, "baseScore": 7.1,
"baseSeverity": "High", "baseSeverity": "High",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1" "version": "3.1"
} }
}, },
"problemtype": { "problemtype": {
"problemtype_data": [ "problemtype_data": [
{ {
"description": [ "description": [
{ {
"lang": "eng", "lang": "eng",
"value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
} }
] ]
} }
] ]
}, },
"references": { "references": {
"reference_data": [ "reference_data": [
{ {
"refsource": "CONFIRM", "refsource": "MISC",
"url": "https://www.dell.com/support/kbdoc/en-us/000191057/dsa-2021-163-dell-supportassist-client-consumer-security-update-for-two-vulnerabilities" "url": "https://www.dell.com/support/kbdoc/en-us/000191057/dsa-2021-163-dell-supportassist-client-consumer-security-update-for-two-vulnerabilities",
"name": "https://www.dell.com/support/kbdoc/en-us/000191057/dsa-2021-163-dell-supportassist-client-consumer-security-update-for-two-vulnerabilities"
} }
] ]
} }

43
2021/36xxx/CVE-2021-36297.json
View File

@ -1,10 +1,10 @@
{ {
"CVE_data_meta": { "CVE_data_meta": {
"ASSIGNER": "secure@dell.com", "ASSIGNER": "secure@dell.com",
"DATE_PUBLIC": "2021-08-31", "DATE_PUBLIC": "2021-08-31",
"ID": "CVE-2021-36297", "ID": "CVE-2021-36297",
"STATE": "PUBLIC" "STATE": "PUBLIC"
}, },
"affects": { "affects": {
"vendor": { "vendor": {
"vendor_data": [ "vendor_data": [
@ -12,59 +12,60 @@
"product": { "product": {
"product_data": [ "product_data": [
{ {
"product_name": "SupportAssist Client Consumer", "product_name": "SupportAssist Client Consumer",
"version": { "version": {
"version_data": [ "version_data": [
{ {
"version_affected": "=", "version_affected": "=",
"version_value": "3.8, 3.9" "version_value": "3.8, 3.9"
} }
] ]
} }
} }
] ]
}, },
"vendor_name": "Dell" "vendor_name": "Dell"
} }
] ]
} }
}, },
"data_format": "MITRE", "data_format": "MITRE",
"data_type": "CVE", "data_type": "CVE",
"data_version": "4.0", "data_version": "4.0",
"description": { "description": {
"description_data": [ "description_data": [
{ {
"lang": "eng", "lang": "eng",
"value": "SupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that allows attackers to load an arbitrary .dll file via .dll planting/hijacking, only by a separate administrative action that is not a default part of the SOSInstallerTool.exe installation for executing arbitrary dll's," "value": "SupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that allows attackers to load an arbitrary .dll file via .dll planting/hijacking, only by a separate administrative action that is not a default part of the SOSInstallerTool.exe installation for executing arbitrary dll's,"
} }
] ]
}, },
"impact": { "impact": {
"cvss": { "cvss": {
"baseScore": 7.8, "baseScore": 7.8,
"baseSeverity": "High", "baseSeverity": "High",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1" "version": "3.1"
} }
}, },
"problemtype": { "problemtype": {
"problemtype_data": [ "problemtype_data": [
{ {
"description": [ "description": [
{ {
"lang": "eng", "lang": "eng",
"value": "CWE-426: Untrusted Search Path" "value": "CWE-426: Untrusted Search Path"
} }
] ]
} }
] ]
}, },
"references": { "references": {
"reference_data": [ "reference_data": [
{ {
"refsource": "CONFIRM", "refsource": "MISC",
"url": "https://www.dell.com/support/kbdoc/en-us/000191057/dsa-2021-163-dell-supportassist-client-consumer-security-update-for-two-vulnerabilities" "url": "https://www.dell.com/support/kbdoc/en-us/000191057/dsa-2021-163-dell-supportassist-client-consumer-security-update-for-two-vulnerabilities",
"name": "https://www.dell.com/support/kbdoc/en-us/000191057/dsa-2021-163-dell-supportassist-client-consumer-security-update-for-two-vulnerabilities"
} }
] ]
} }