Weak Password Recovery Mechanism in Dell SCG Policy Manager Could Lead to Unauthorized Access

CVE-2024-24903

Summary

The Dell Secure Connect Gateway Policy Manager, starting from version 5.10, exhibits a significant vulnerability due to its weak password recovery mechanism. This flaw allows an adjacent network attacker with low privileges to potentially exploit the system. The attacker may retrieve the password reset token without necessary authorization, subsequently allowing them to change the password and gain unauthorized access to the application with the privileges associated with the compromised account. It is crucial for users to review security practices regarding password recovery mechanisms to mitigate risks associated with unauthorized access.

References