Multiple vulnerabilities in Dell Networker

Published: 2023-07-20

Risk	High
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2022-22978 CVE-2022-31692
CWE-ID	CWE-285
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available.
Vulnerable software Subscribe	NetWorker Server applications / Other server solutions
Vendor	Dell

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Improper Authorization

EUVDB-ID: #VU63345

Risk: High

CVSSv3.1: 7.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2022-22978

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to bypass authorization process.

The vulnerability exists due to input validation error when processing untrusted input in applications that are using RegexRequestMatcher with `.` in the regular expression. A remote non-authenticated attacker can bypass authorization checks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

NetWorker: before 19.9

External links

http://www.dell.com/support/kbdoc/nl-nl/000215283/dsa-2023-155-security-update-for-dell-networker-spring-security-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Improper Authorization

EUVDB-ID: #VU68866

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-31692