Host Header Injection in Dell EMC Data Protection Central
CVE-2022-45102

5.4MEDIUM

Key Information:

Vendor
Dell
Status
Data Protection Central
Vendor
CVE Published:
1 February 2023

Summary

Dell EMC Data Protection Central, from versions 19.1 to 19.7, is susceptible to a Host Header Injection vulnerability, which allows a remote unauthenticated attacker to manipulate 'Host' header values. This could potentially lead to web cache poisoning or unauthorized redirections, compromising the integrity and availability of the services reliant on this web interface.

Affected Version(s)

Data Protection Central 19.1 <= 19.7

References

https://www.dell.com/support/kbdoc/en-us/000206329/dsa-20...
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.