#VU21442 Improper Restriction of Excessive Authentication Attempts in EMC Integrated Data Protection Appliance


Published: 2019-09-30

Vulnerability identifier: #VU21442

Vulnerability risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3746

CWE-ID: CWE-307

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
EMC Integrated Data Protection Appliance
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor: Dell

Description

The vulnerability allows a remote attacker to gain access to the system.

The vulnerability exists due to the affected software does not limit the number of authentication attempts to the ACM API. A remote authenticated attacker can launch a brute-force authentication attack and gain access to the target system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

EMC Integrated Data Protection Appliance: 2.0 - 2.2

External links
http://www.dell.com/support/security/en-us/details/536363/DSA-2019-112-Dell-EMC-Integrated-Data-Protection-Appliance-Multiple-Vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Multiple vulnerabilities in Dell EMC Integrated Data Protection Appliance