Dell PowerFlex Appliance and Rack Versions vulnerable to Information Disclosure
CVE-2024-37144

8.2HIGH

Key Information:

Vendor

Dell
Status
Dell Powerflex Appliance
Dell Powerflex Rack
Dell Powerflex Custom Node
Dell Insightiq
Vendor
CVE Published:
10 December 2024

What is CVE-2024-37144?

The vulnerability in Dell PowerFlex appliances, including certain rack versions and related software products, arises from insecure storage of sensitive information. A privileged attacker with local access could exploit this weakness, potentially leading to unauthorized information disclosure. This exposure might enable the attacker to gain access to critical components within the cluster, which raises serious security concerns. Organizations utilizing affected versions are advised to upgrade to the latest releases to mitigate risks associated with this vulnerability.

Affected Version(s)

Dell Data Lakehouse < 1.2.0.0

Dell InsightIQ < 5.1.1

Dell PowerFlex appliance < 46.381.00

References

https://www.dell.com/support/kbdoc/en-us/000258342/dsa-20...
vendor-advisory

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-37144 : Dell PowerFlex Appliance and Rack Versions vulnerable to Information Disclosure