Exposed Auth Token in Dell EMC CloudLink Leading to Unauthorized Access

CVE-2022-24414

Summary

Dell EMC CloudLink versions 7.1.3 and earlier are susceptible to a vulnerability where authentication tokens are exposed through GET request parameters. This exposure can lead to sensitive token information being logged in reverse proxies and server logs, making it possible for attackers to intercept these tokens. The presence of these tokens in the request URLs poses a significant security risk, as they may be utilized to gain unauthorized access to the CloudLink server. It is crucial for users of affected versions to implement secure practices and refrain from using tokens in request URLs to mitigate potential exploits.

References