iDRAC6/iDRAC7/iDRAC8 - Weak CGI session ID vulnerability
CVE-2018-1243

7.5HIGH

Key Information:

Vendor
Dell
Status
Idrac6
Idrac7
Idrac8
Vendor
CVE Published:
2 July 2018

Summary

Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers to perform bruteforce session guessing attacks.

Affected Version(s)

iDRAC6 < 2.91

iDRAC7 < 2.60.60.60

iDRAC8 < 2.60.60.60

References

http://en.community.dell.com/techcenter/extras/m/white_pa...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dell EMC would like to thank Check Point Software Technologies Ltd. for reporting the issue to us.
.