Multiple vulnerabilities in Dell Support Assist Enterprise

1) Information disclosure

EUVDB-ID: #VU12798

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-8014

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Security restrictions bypass

EUVDB-ID: #VU8698

Risk: Low

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-7675

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to a flaw in the HTTP/2 implementation. A remote attacker can use a specially crafted URL and bypass security restraints to conduct further attacks.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper input validation

EUVDB-ID: #VU8669

Risk: High

CVSSv3.1: 9.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2017-12617

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to insufficient validation of user-supplied input when running with HTTP PUTs enabled. A remote attacker can send a specially crafted request to upload a JSP file to the server and execute arbitrary code on the system.

Successful exploitation of the vulnerability may result in full system compromise.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

4) Security restrictions bypass

EUVDB-ID: #VU13992

Risk: Low

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-8034

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to host name verification when using TLS with the WebSocket client was missing. A remote unauthenticated attacker can bypass security restrictions when using TLS.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Infinite loop

EUVDB-ID: #VU13986

Risk: Medium

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1336

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to improper handing of overflow in the UTF-8 decoder with supplementary characters. A remote attacker can send trigger an infinite loop in the decoder and cause the service to crash.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource exhaustion

EUVDB-ID: #VU18067

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0199

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists within the HTTP/2 implementation in Apache Tomcat that accepts streams with excessive numbers of SETTINGS frames and also permits clients to keep streams open without reading/writing request/response data. A remote attacker can exhaust all available threads on the server and perform denial of service attack.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Resource management error

EUVDB-ID: #VU20992

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-10072

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incomplete fix for SB2019020812 when processing HTTP/2 requests. A remote attacker can perform denial of service attack by not sending WINDOW_UPDATE messages for the connection window (stream 0).

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Session Fixation

EUVDB-ID: #VU25002

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-17563

CWE-ID: CWE-384 - Session Fixation

Exploit availability: No

The vulnerability allows a remote attacker to perform a session fixation attack.

The vulnerability exists due to a race condition when FORM authentication is used in Apache Tomcat. A remote attacker can use a narrow window to perform a session fixation attack.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU25000

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-12418

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the local user without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface.

Successful vulnerability exploitation requires that Apache Tomcat is configured with the JMX Remote Lifecycle Listener.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Deserialization of Untrusted Data

EUVDB-ID: #VU28158

Risk: High

CVSSv3.1: 7.3 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-9484

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in uploaded files names. A remote attacker can pass specially crafted file name to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that the server is configured to use PersistenceManager with a FileStore and the attacker knows relative file path from storage location.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

11) Resource management error

EUVDB-ID: #VU29333

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-11996

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: Yes

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources with the application when processing HTTP/2 requests. A remote attacker can send specially crafted sequence of HTTP/2 requests to the affected server and trigger high CPU load for several seconds. A large number of such requests causes denial of service.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

12) Resource management error

EUVDB-ID: #VU29724

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-13934

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources when processing h2 direct connections. A remote attacker can pass specially crafted HTTP/2 requests to the server and consume all available memory.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

13) Infinite loop

EUVDB-ID: #VU29723

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-13935

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: Yes

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when processing payload length in a WebSocket frame. A remote attacker can send a specially crafted request to the application, consume all available system resources and cause denial of service conditions.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

14) Path traversal

EUVDB-ID: #VU25502

Risk: High

CVSSv3.1: 9.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2020-1938

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Apache Tomcat AJP connector. A remote attacker can send a specially crafted AJP request, include and execute arbitrary files on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

15) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU25807

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-1935

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

The vulnerability allows a remote attacker to perform HTTP request smuggling attack.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) XML External Entity injection

EUVDB-ID: #VU93359

Risk: Low

CVSSv3.1: 4.4 [CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-5000

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input. A local user can trick the victim into opening a specially crafted XML code and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) XML Entity Expansion

EUVDB-ID: #VU86355

Risk: Low

CVSSv3.1: 4.4 [CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-5644

CWE-ID: CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to insufficient validation of user-supplied XML input. A local user can pass a specially crafted OOXML file to the affected application and perform a denial of service attack.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) XML External Entity injection

EUVDB-ID: #VU22545

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-12415

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents. A remote attacker can pass a specially crafted XML code to the affected application and read files from the local filesystem or from internal network resources on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Infinite loop

EUVDB-ID: #VU12842

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-12626

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to infinite loops while parsing specially crafted WMF, EMF, MSG and macros and out of Memory exceptions while parsing specially crafted DOC, PPT and XLS. A remote attacker can cause the service to crash.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Improper input validation

EUVDB-ID: #VU49795

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2016-5725

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Install, config, upgrade (JCraft JSch) component in Oracle Data Integrator. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

21) XXE attack

EUVDB-ID: #VU12143

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-9116

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The weakness exists due to the inclusion of remote Document Type Definition (DTD) documents when using XPath or XML matching. A remote attacker can send a specially crafted request, trigger CPU saturation and cause the service to crash. 

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Path traversal

EUVDB-ID: #VU11449

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-9117

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper processing of XML requests. A remote attacker can send a specially crafted XML request, gain access to potentially sensitive information, such as local files.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18276

Risk: Medium

CVSSv3.1: 4.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-11068

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to an error within the xsltCheckRead() and xsltCheckWrite() functions when processing requests from remote servers. A remote attacker can trick the victim into opening a specially crafted URL that will result in "-1 error" code but the URL itself will be processed by the application later.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Improper access control

EUVDB-ID: #VU77073

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-0107

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to TransformerFactory in Apache Xalan-Java does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled. A remote attacker can bypass implemented security restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Privilege escalation

EUVDB-ID: #VU16559

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-15288

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to the compilation daemon uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port. A local attacker can write to arbitrary class files and consequently gain privileges.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Improper input validation

EUVDB-ID: #VU27264

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-5398

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the System Administration (Spring Framework) component in Oracle Retail Order Broker. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

27) Input validation error

EUVDB-ID: #VU77716

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1199

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to Spring Security does not consider URL path parameters when processing security constraints. A remote attacker can pass specially crafted input to the application and gain access to sensitive information.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Security bypass

EUVDB-ID: #VU6950

Risk: Low

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-5664

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to improper handling of certain HTTP request methods for static error pages in Default Servlet. A remote attacker can bypass HTTP method restrictions and cause the error page to be deleted or replaced.

Successful exploitation of the vulnerability results in information modification.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Cross-site scripting

EUVDB-ID: #VU18638

Risk: Low

CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-0221

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: Yes

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data within SSI printenv command, when parsing URI. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Example:

http://[host]/printenv.shtml?%3Cscript%3Ealert(%27xss%27)%3C/script%3E

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

30) Improper input validation

EUVDB-ID: #VU12650

Risk: Medium

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1257

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The weakness exists in the spring-messaging module due to improper processing of messages by applications, which expose Simple Text Orientated Messaging Protocol (STOMP) over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A remote attacker can send a specially crafted message and conduct ReDoS attack.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Cross-site scripting

EUVDB-ID: #VU27953

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-1941

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data within the webconsole admin GUI. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Cryptographic issues

EUVDB-ID: #VU35763

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-10101

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

JetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Input validation error

EUVDB-ID: #VU35764

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-10102

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. This issue was fixed in Kotlin plugin version 1.3.30.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Input validation error

EUVDB-ID: #VU35765

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-10103

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

JetBrains IntelliJ IDEA projects created using the Kotlin (JS Client/JVM Server) IDE Template were resolving Gradle artifacts using an http connection, potentially allowing an MITM attack. This issue, which was fixed in Kotlin plugin version 1.3.30, is similar to CVE-2019-10101.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Use of insufficiently random values

EUVDB-ID: #VU28463

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-5408

CWE-ID: CWE-330 - Use of Insufficiently Random Values

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected software uses a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A remote authenticated attacker can derive the unencrypted values using a dictionary attack.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Input validation error

EUVDB-ID: #VU93233

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-12197

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to bypass security restrictions and gain access to sensitive information.

The vulnerability exists due to libpam4j did not properly validate user accounts when authenticating. A local user can bypass security restrictions and gain access to sensitive information.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Improper Certificate Validation

EUVDB-ID: #VU93354

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-5653

CWE-ID: CWE-295 - Improper Certificate Validation

Exploit availability: No

The vulnerability allows a remote attacker to modify data on the system.

The vulnerability exists due to JAX-RS XML Security streaming clients in Apache CXF do not validate that the service response was signed or encrypted. A remote attacker can trigger the vulnerability to modify data on the system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Data handling

EUVDB-ID: #VU11285

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-12624

CWE-ID: CWE-19 - Data Handling

Exploit availability: No

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to data handling. A remote attacker can send specially crafted message attachment header and cause the service to crash.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Resource management error

EUVDB-ID: #VU22577

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-12406

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the affected software does not restrict the number of message attachments present in a given message. A remote authenticated attacker can craft a message containing a very large number of message attachments and cause a denial of service condition on the target system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Man-in-the-Middle (MitM) attack

EUVDB-ID: #VU26530

Risk: Low

CVSSv3.1: 6.2 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-1954

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

Exploit availability: No

The vulnerability allows a remote attacker to perform a man-in-the-middle (MitM) attack.

The vulnerability exists in the JMX Integration when the "createMBServerConnectorFactory" property of the default InstrumentationManagerImpl is not disabled. A remote attacker on the same host can perform a man-in-the-middle attack and gain access to all of the information that is sent and received over JMX. 

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Session Fixation

EUVDB-ID: #VU93356

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-5656

CWE-ID: CWE-384 - Session Fixation

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to Apache CXF's STSClient uses a flawed way of caching tokens that are associated with delegation tokens. A remote attacker can craft a token which would return an identifer corresponding to a cached token for another user.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Man-in-the-middle attack

EUVDB-ID: #VU13523

Risk: Low

CVSSv3.1: 4.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-8039

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

Exploit availability: No

The vulnerability allows a remote authenticated attacker to conduct man-in-the-middle attack on the target system.

The weakness exists due to improper verification of TLS hostnames when used with the 'com.sun.net.ssl' implementation. A remote attacker can conduct a man-in-the-middle attack and bypass the hostname verification.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Insufficiently protected credentials

EUVDB-ID: #VU27701

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-12423

CWE-ID: CWE-522 - Insufficiently Protected Credentials

Exploit availability: No

The vulnerability allows a remote attacker to gain access ti sensitive information.

The vulnerability exists due to the application allows a client to obtain the keys from a JWK keystore file, by setting the configuration parameter "rs.security.keystore.type" to "jwk". A remote non-authenticated attacker can obtain all private key and secret key credentials and gain unauthorized access to the application.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Improper Authentication

EUVDB-ID: #VU46670

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-13920

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Open redirect

EUVDB-ID: #VU15156

Risk: Low

CVSSv3.1: 2.8 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-11784

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Exploit availability: Yes

The vulnerability allows a remote attacker to redirect victims to arbitrary URI.

The vulnerability exists due to improper sanitization of user-supplied data. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary URI.

Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

46) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU22825

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-16869

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

The vulnerability allows a remote attacker to perform HTTP request smuggling attack.

The vulnerability exists due to improper input validation when processing a whitespace before the colon in HTTP headers (e.g. "Transfer-Encoding : chunked"). A remote attacker can send a specially crafted HTTP request and perform HTTP request smuggling attack.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU25355

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-20444

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to incorrect processing of HTTP headers without the colon within the HttpObjectDecoder.java file in Netty. A remote attacker can send a specially crafted HTTP request to the application and perform HTTP request smuggling attack.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

48) HTTP response splitting

EUVDB-ID: #VU25598

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-20445

CWE-ID: CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

Exploit availability: No

The vulnerability allows a remote attacker to perform HTTP splitting attacks.

The vulnerability exists due to software does not corrector process CRLF character sequences within the HttpObjectDecoder.java in Netty, which allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header. A remote attacker can send specially crafted request containing CRLF sequence and make the application to send a split HTTP response.

Successful exploitation of the vulnerability may allow an attacker perform cache poisoning attack.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Resource exhaustion

EUVDB-ID: #VU27513

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-11612

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within ZlibDecoders in Netty while decoding a ZlibEncoded byte stream. A remote attacker can trigger resource exhaustion by passing an overly large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Cryptographic issues

EUVDB-ID: #VU93357

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-4461

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to Jetty computes hash values for form parameters without restricting the ability to trigger hash collisions predictably. A remote attacker can cause a denial of service (CPU consumption) by sending many crafted parameters.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Brute-force attack

EUVDB-ID: #VU9654

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-9735

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

Exploit availability: No

The vulnerability allows a remote attacker to perform a brute-force attack.

The vulnerability exists due to a timing channel in util/security/Password.java, which allows a remote attacker to perform a brute-force attack by observing elapsed times before rejection of incorrect passwords.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) HTTP request smuggling attack

EUVDB-ID: #VU13527

Risk: Low

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-7656

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to conduct an HTTP request smuggling attack on the target system.

The vulnerability exists due to improper handling of HTTP/0.9 requests. A remote attacker can send a specially crafted HTTP/0.9 request that submits malicious request headers, cause the software and an upstream HTTP agent to misinterpret the boundary of the request and poison the web cache on the system, which could be used to conduct further attacks.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Information disclosure

EUVDB-ID: #VU13528

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-7657

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The disclosed vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due to improper handling of queries that do not match the dynamic URL pattern for webapps that use default error handling settings. A remote attacker can send a query that submits malicious input, trigger a java.nio.file.InvalidPathException message, which could allow the attacker to view sensitive information, such as the software installation path.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Race condition

EUVDB-ID: #VU48942

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-27216

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition. On Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Improper input validation

EUVDB-ID: #VU8697

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-7674

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to conduct client and server side cache poisoning.

The weakness exists due to the failure to add an HTTP Vary header indicating that the response varies depending on Origin by the CORS Filter. A remote attacker can trick the victim to follow a specially crafted link and conduct client and server side cache poisoning.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Security restrictions bypass

EUVDB-ID: #VU10706

Risk: Low

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1305

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to security constraints defined by annotations of Servlets are only applied once a Servlet had been loaded. A remote attacker can supply a specially crafted URL pattern and any URLs below that point, bypass security restrictions and gain unauthorised access to arbitrary resources.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Security restrictions bypass

EUVDB-ID: #VU10707

Risk: Low

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1304

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to the URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled when used as part of a security constraint definition. A remote attacker can supply a specially crafted URL, bypass security restrictions and gain unauthorised access to web application resources.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Information disclosure

EUVDB-ID: #VU13993

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-8037

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due to improper handling of connection closures by the non-blocking I/O (NIO) and NIO2 connectors. A remote unauthenticated attacker can send a specially crafted request that submits malicious input, trigger bug in the tracking of connection closures, reuse user sessions in a new connection and access arbitrary data.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Path traversal

EUVDB-ID: #VU11752

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1271

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information and write arbitrary files on the target system.

The weakness exists in the spring-webmvc module due to the improper serving of static resources from a file system on Microsoft Windows systems. A remote attacker can send a malicious request using a crafted URL, trigger directory traversal, overwrite, delete or read potentially sensitive file information.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Cross-site tracing attack

EUVDB-ID: #VU13499

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-11039

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site tracing (XST) attacks.

The vulnerability exists due to the HiddenHttpMethodFilter class in the Spring MVC framework used by the affected software allows web applications to change the HTTP request method to any HTTP method, including the TRACE method. A remote attacker can trick a user who is using a web application that has a cross-site scripting (XSS) vulnerability into following a link that submits malicious input, conduct an XST attack and access sensitive information, such as the user's credentials. 

Successful exploitation of the vulnerability results in information disclosure.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Input validation error

EUVDB-ID: #VU21580

Risk: Medium

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-16942

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to compromise the affected application.

The vulnerability exists due to a Polymorphic Typing issue when processing JSON requests  within the org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSourc components. A remote attacker can send specially crafted JSON data to an RMI service endpoint and execute arbitrary code on he system.

Successful exploitation of the vulnerability requires that Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to send requests to.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Deserialization of untrusted data

EUVDB-ID: #VU11268

Risk: High

CVSSv3.1: 7.8 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-7489

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote unauthenticated attacker to bypass security restrictions and execute arbitrary code on the target system.

The weakness exists in the readValue method due to improper validation of user-input. A remote attacker can send malicious JSON input, bypass security restrictions and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Remote code execution

EUVDB-ID: #VU17053

Risk: High

CVSSv3.1: 7.8 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-14718

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to the failure to block the slf4j-ext class from polymorphic deserialization. A remote attacker can execute arbitrary code with elevated privileges.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Input validation error

EUVDB-ID: #VU17778

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-14719

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The disclosed vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to fail to block blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization. A remote attacker can send a specially crafted request that submits malicious input to execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) XXE attack

EUVDB-ID: #VU17777

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-14720

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform XXE attacks.

The vulnerability exists due to fail to block unspecified Java Development Kit (JDK) classes from polymorphic deserialization. A remote attacker can send a specially crafted request that submits malicious input, conduct an XXE attack to access sensitive information, bypass security restrictions, or cause a denial of service (DoS) condition on the targeted system. 

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Input validation error

EUVDB-ID: #VU17780

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-19360

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The disclosed vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code.

The vulnerability exists due to fail to block the axis2-transport-jmsclass from polymorphic deserialization. A remote attacker can send a specially crafted request that submits malicious input to perform unauthorized actions on the system, which could allow the attacker to execute arbitrary code or cause a denial of service (DoS) condition.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Input validation error

EUVDB-ID: #VU17779

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-19361

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The disclosed vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code.

The vulnerability exists due to fail to block the openjpa class from polymorphic deserialization. A remote attacker can send a specially crafted request that submits malicious input to perform unauthorized actions on the system, which could allow the attacker to execute arbitrary code or cause a denial of service (DoS) condition.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Input validation error

EUVDB-ID: #VU17781

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-19362

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The disclosed vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code.

The vulnerability exists due to fail to block the jboss-common-coreclass from polymorphic deserialization. A remote attacker can send a specially crafted request that submits malicious input to perform unauthorized actions on the system, which could allow the attacker to execute arbitrary code or cause a denial of service (DoS) condition.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU17776

Risk: Low

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-14721

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to fail to block the axis2-jaxws class from polymorphic deserialization. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Deserialization of Untrusted Data

EUVDB-ID: #VU19938

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-11307

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the usage of default typing along with a gadget class from iBatis, which allows exfiltration of content. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU19933

Risk: High

CVSSv3.1: 8.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-14379

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on a targeted system.

The vulnerability exists due to the "SubTypeValidator.java" file mishandles default typing when Ehcache is used. A remote attacker can send a request that submits malicious input to the targeted system and execute arbitrary code.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Information disclosure

EUVDB-ID: #VU21135

Risk: Medium

CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-14540

CWE-ID: CWE-200 - Information exposure

Exploit availability: Yes

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a polymorphic typing issue in the "com.zaxxer.hikari.HikariConfig". A remote attacker can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

73) Information disclosure

EUVDB-ID: #VU21136

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-16335

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a polymorphic typing issue in the "com.zaxxer.hikari.HikariDataSource". A remote attacker can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Input validation error

EUVDB-ID: #VU21593

Risk: Medium

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-16943

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to compromise the affected application.

The vulnerability exists due to a Polymorphic Typing issue when processing JSON requests  within the com.p6spy.engine.spy.P6DataSource component. A remote attacker can send specially crafted JSON data to an RMI service endpoint and execute arbitrary code on he system.

Successful exploitation of the vulnerability requires that Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to send requests to.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Remote code execution

EUVDB-ID: #VU9607

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-15095

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists in the jackson-databind development library due to improper implementation of blacklists for input handled by the ObjectMapper object readValue method. A remote unauthenticated attacker can send a malicious input and execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Input validation error

EUVDB-ID: #VU21594

Risk: Medium

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-17267

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to compromise the affected application.

The vulnerability exists due to a Polymorphic Typing issue within the net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup component. A remote attacker can execute arbitrary code on he system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Input validation error

EUVDB-ID: #VU21750

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-17531

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to compromise the affected software.

The vulnerability exists due to a Polymorphic Typing in jackson-databind when processing JSON requests. A remote attacker can send specially crafted JSON data to JNDI service and execute a malicious payload.

Successful exploitation of the vulnerability requires that Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Improper access control

EUVDB-ID: #VU24272

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-20330

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions related to net.sf.ehcache in FasterXML jackson-databind. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Code Injection

EUVDB-ID: #VU25469

Risk: Medium

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-8840

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to absence of xbean-reflect/JNDI gadget blocking. A remote attacker can pass specially crafted input to the application and execute arbitrary Java code on the system, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

80) Deserialization of Untrusted Data

EUVDB-ID: #VU25830

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-9546

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: This vulnerability is related to:

• org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config)

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Deserialization of Untrusted Data

EUVDB-ID: #VU25831

Risk: High

CVSSv3.1: 8.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-9547

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: This vulnerability is related to:

• com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap)

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

82) Deserialization of Untrusted Data

EUVDB-ID: #VU25832

Risk: High

CVSSv3.1: 8.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-9548

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: This vulnerability is related to:

• br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core)

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

83) Deserialization of Untrusted Data

EUVDB-ID: #VU25833

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-14892

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data of a malicious object using commons-configuration 1 and 2 JNDI classes. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Deserialization of Untrusted Data

EUVDB-ID: #VU25834

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-14893

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as "enableDefaultTyping()" or when @JsonTypeInfo is using "Id.CLASS" or "Id.MINIMAL_CLASS" or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Deserialization of Untrusted Data

EUVDB-ID: #VU27031

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-11619

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to affected software mishandles the interaction between serialization gadgets and typing, related to "org.springframework.aop.config.MethodLocatingFactoryBean" (aka spring-aop). A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Deserialization of Untrusted Data

EUVDB-ID: #VU27032

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-11620

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the affected software mishandles the interaction between serialization gadgets and typing, related to "org.apache.commons.jelly.impl.Embedded" (aka commons-jelly). A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Deserialization of untrusted data

EUVDB-ID: #VU9128

Risk: High

CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-7525

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to a deserialization flaw in the jackson-databind component. A remote attacker can send a specially crafted input to the readValue method of the ObjectMapper and execute arbitrary code with privileges of the target service.

Successful exploitation of the vulnerability may result in system compromise.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

88) Deserialization of untrusted data

EUVDB-ID: #VU10257

Risk: High

CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-17485

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in the FasterXML jackson-databind library due to improper validation of user-input handled by the readValue method of the ObjectMapper object. A remote attacker can send malicious input to the vulnerable method of a web application that uses the Spring library in the application's classpath and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

89) Information disclosure

EUVDB-ID: #VU13500

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-11040

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The disclosed vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to improper cross-domain protections imposed by the affected software. The software allows web applications to enable cross-domain requests via JSON with Padding (JSONP) through the AbstractJsonpResponseBodyAdvice class for REST controllers and through the MappingJackson2JsonView class for browser requests. A remote attacker can trick the victim into following a link that submits malicious input and access sensitive information.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) Deserialization of Untrusted Data

EUVDB-ID: #VU19943

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-12023

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists when Default Typing is enabled and the service has the Oracle JDBC jar in the classpath. A remote attacker can provide an LDAP service to access and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Improper privilege management

EUVDB-ID: #VU11753

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1272

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

The vulnerability allows a remote authenticated attacker to gain elevated privileges on the target system.

The weakness exists due to improper processing of multipart requests. A remote attacker can make a multipart request that injects malicious content to the target server, cause it to use wrong values and gain root privileges.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) Improper input validation

EUVDB-ID: #VU15467

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-15756

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists in Pivotal Software Spring Framework due to improper handling of range requests. A remote attacker can send a specially crafted request that contains an additional range header with a high number of ranges or with wide ranges that overlap and cause the service to crash.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) Improper input validation

EUVDB-ID: #VU49739

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-5421

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Core (Spring Framework) component in Oracle Communications Session Report Manager. A remote authenticated user can exploit this vulnerability to read and manipulate data.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

94) Improper input validation

EUVDB-ID: #VU11616

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1270

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in the spring-messaging module in Spring Frameworks due to the affected software allows a memory-based Simple/Streaming Text Orientated Messaging Protocol (STOMP) broker to expose STOMP over WebSocket endpoints. A remote attacker can send a message that submits malicious input to the broker and execute arbitrary code.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Improper input validation

EUVDB-ID: #VU12131

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1275

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to allowing applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A remote attacker can submit a sepcially crafted message to the broker and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Symlink attack

EUVDB-ID: #VU11230

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1196

CWE-ID: CWE-61 - UNIX Symbolic Link (Symlink) Following

Exploit availability: No

The vulnerability allows a remote authenticated attacker to conduct symlink attack on the target system.

The weakness exists due to insufficient security restrictions. A remote attacker, with shell access, can conduct symlink attack and overwrite files with elevated privileges.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Improper input validation

EUVDB-ID: #VU11761

Risk: High

CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-8046

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to improper input validation. A remote attacker can submit specially crafted JSON data and execute arbitrary Java code.

Successful exploitation of the vulnerability may result in system compromise.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

98) Input validation error

EUVDB-ID: #VU16786

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1000873

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can trick the victim into deserializing of crafted input with specifically very large values in the nanoseconds field of a time value and cause the service to crash.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Information disclosure

EUVDB-ID: #VU18961

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-12814

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) Deserialization of Untrusted Data

EUVDB-ID: #VU19018

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-12384

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to software allows the logback-core class to process polymorphic deserialization. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Deserialization of untrusted data

EUVDB-ID: #VU10610

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-5968

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists due to deserialization flaw. A remote attacker can supply specially crafted input, execute arbitrary code and bypass a blacklist on the target system.

Successful exploitation of the vulnerability may result in system compromise.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) Deserialization of Untrusted Data

EUVDB-ID: #VU19942

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-12022

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists when Default Typing is enabled and the service has the Jodd-db jar in the classpath. A remote attacker can provide an LDAP service to access and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) Information disclosure

EUVDB-ID: #VU19941

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-12086

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a polymorphic typing issue when Default Typing is enabled for an externally exposed JSON endpoint and the service has the mysql-connector-java jar in the classpath. A remote attacker can send a specially crafted JSON message and read arbitrary local files on the server due to the missing "com.mysql.cj.jdbc.admin.MiniAdmin" validation.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

104) Deserialization of Untrusted Data

EUVDB-ID: #VU47105

Risk: High

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-24750

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: Yes

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration. A remote attacker can execute arbitrary code on the target system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

105) Information disclosure

EUVDB-ID: #VU19937

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-14439

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a polymorphic typing issue when Default Typing is enabled for an externally exposed JSON endpoint and the service has the logback jar in the classpath. A remote attacker can send a specially crafted JSON message and gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) Deserialization of Untrusted Data

EUVDB-ID: #VU26493

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10672

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Deserialization of Untrusted Data

EUVDB-ID: #VU26494

Risk: High

CVSSv3.1: 8.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-10673

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

108) Deserialization of Untrusted Data

EUVDB-ID: #VU26491

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10968

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) Deserialization of Untrusted Data

EUVDB-ID: #VU26492

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10969

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing, related to  javax.swing.JEditorPane. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) Deserialization of Untrusted Data

EUVDB-ID: #VU26488

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-11111

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing, related to org.apache.activemq.*. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) Deserialization of Untrusted Data

EUVDB-ID: #VU26489

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-11112

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) Deserialization of Untrusted Data

EUVDB-ID: #VU26490

Risk: High

CVSSv3.1: 8.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-11113

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

113) Deserialization of Untrusted Data

EUVDB-ID: #VU29131

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-14061

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms). A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Deserialization of Untrusted Data

EUVDB-ID: #VU29130

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-14062

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2). A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

115) Deserialization of Untrusted Data

EUVDB-ID: #VU29129

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-14060

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill). A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

116) Deserialization of Untrusted Data

EUVDB-ID: #VU29128

Risk: High

CVSSv3.1: 8.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-14195

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity). A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

117) Code Injection

EUVDB-ID: #VU46305

Risk: High

CVSSv3.1: 7.3 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-24616

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: Yes

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

Install update from vendor's website.

Dell Support Assist Enterprise: 4.00.05.00

• cpe:2.3:a:dell:dell_support_assist_enterprise:4.00.05.00:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000183617/dsa-2021-047-dell-supportassist-enterprise-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.