Arithmetic Overflow Vulnerability in Dell ECS Products
CVE-2024-51540

6.5MEDIUM

Key Information:

Vendor
Dell
Status
Ecs
Vendor
CVE Published:
26 December 2024

Summary

An arithmetic overflow vulnerability has been identified in Dell ECS that affects versions prior to 3.8.1.3. This vulnerability arises from improper handling of retention periods, enabling authenticated users with bucket or object-level access, along with the necessary privileges, to potentially exploit this flaw. As a result, they could bypass established retention policies and delete objects within the system, posing a significant risk to data integrity and security.

Affected Version(s)

ECS < 3.8.1.3

References

https://www.dell.com/support/kbdoc/en-us/000256642/dsa-20...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.