Dell PowerProtect Data Manager Vulnerability: Unauthorized Access via Weak Password Recovery Mechanism

CVE-2024-22454

Summary

The vulnerability affects Dell PowerProtect Data Manager versions 19.15 and earlier, which incorporate a weak password recovery mechanism. This flaw enables a remote unauthenticated attacker to exploit the system. The attacker could retrieve a reset password token without proper authorization, allowing them to gain unauthorized access to the application with the privileges of the compromised account. This presents serious security risks, as attackers can manipulate account access and potentially lead to data breaches.

References