CVE-2019-3746

published 2019-09-27

CVE-2019-3746: Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote…

Priority P3 57 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote user may exploit this vulnerability to launch a brute-force authentication attack in order to gain access to the system.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
dell	emc_integrated_data_protection_appliance_firmware	—	—
dell	emc_integrated_data_protection_appliance_firmware	—	—
dell	emc_integrated_data_protection_appliance_firmware	—	—
dell	integrated_data_protection_appliance	—	—

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-307