SQL Injection Vulnerability in Dell iDRAC9 Remote Management System
CVE-2021-36299

7.1HIGH

Key Information:

Vendor

Dell
Status
Integrated Dell Remote Access Controller (idrac)
Vendor
CVE Published:
23 November 2021

What is CVE-2021-36299?

The SQL injection vulnerability in Dell iDRAC9 allows remote authenticated users with limited privileges to exploit the system. By submitting specially crafted input data, an attacker could potentially disclose sensitive information or disrupt services. This issue arises in specific versions of the iDRAC9 system, necessitating immediate attention and remediation.

Affected Version(s)

Integrated Dell Remote Access Controller (iDRAC) < 5.00.00.00

References

https://support.emc.com/kb/000191229
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.