CVE-2023-44285: dell apex_protection_storage

Vulnerability summary

CVE-2023-44285 is a high (CVSS 7.8) vulnerability in dell apex_protection_storage. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.9% of scored vulnerabilities.

Timeline

1. 14-12-2023
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an improper access control vulnerability. A local malicious user with low privileges could potentially exploit this vulnerability leading to escalation of privilege.

• CWE-1220Insufficient Granularity of Access ControlThe product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.