CVE-2024-37130: dell dell openmanage server administrator Uncontrolled Search Path Element

Vulnerability summary

CVE-2024-37130 is a high (CVSS 7.8) Uncontrolled Search Path Element vulnerability in dell dell openmanage server administrator. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.9% of scored vulnerabilities.

Timeline

1. 11-06-2024
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains a Local Privilege Escalation vulnerability via XSL Hijacking. A local low-privileged malicious user could potentially exploit this vulnerability and escalate their privilege to the admin user and gain full control of the machine. Exploitation may lead to a complete system compromise.

• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.