Dell SCG Vulnerable to SQL Injection Attacks

CVE-2024-29169
5.4MEDIUM

Key Information

Vendor
Dell
Status
Secure Connect Gateway-application
Secure Connect Gateway-appliance
Vendor
CVE Published:
13 June 2024

Summary

Dell SCG, versions prior to 5.22.00.00, contain a SQL Injection Vulnerability in the SCG UI for an internal audit REST API. A remote authenticated attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend database causing potential unauthorized access and modification of application data.

Affected Version(s)

Secure Connect Gateway-Application <= 5.22.00.18

Secure Connect Gateway-Appliance <= 5.22.00.18

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database

Credit

Dell would like to thank saltedfish for reporting this issue
.