« Volver al listado

CVE-2019-3746

Estado: ModificadaAlta (8.8)—

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote user may exploit this vulnerability to launch a brute-force authentication attack in order to gain access to the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dell — EMC Integrated Data Protection Appliance Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-3746",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security_alert@emc.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "Integrated Data Protection Appliance",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 2.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-09-27T21:15:10.143",
  "references": [
    {
      "url": "https://www.dell.com/support/security/en-us/details/536363/DSA-2019-112-Dell-EMC-Integrated-Data-Protection-Appliance-Multiple-Vulnerabilities",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://www.dell.com/support/security/en-us/details/536363/DSA-2019-112-Dell-EMC-Integrated-Data-Protection-Appliance-Multiple-Vulnerabilities",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security_alert@emc.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-307"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-307"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote user may exploit this vulnerability to launch a brute-force authentication attack in order to gain access to the system."
    },
    {
      "lang": "es",
      "value": "Dell EMC Integrated Data Protection Appliance versiones  anteriores a 2.3, no limitan el número de intentos de autenticación a la API de ACM. Un usuario remoto autenticado puede explotar esta vulnerabilidad para iniciar un ataque de autenticación de fuerza bruta con el fin de conseguir acceso al sistema."
    }
  ],
  "lastModified": "2026-06-17T02:35:30.230",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C133A08-973B-43E2-8E0C-9B7AEF467BDD"
            },
            {
              "criteria": "cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "889D0DDB-7D31-4AE9-972A-AE14CC2A82BF"
            },
            {
              "criteria": "cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "970D60B9-9DAD-4F1D-BFBE-BB069756011C"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:dell:emc_idpa_dp4400:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "70B89DD8-CEE9-4C3D-828D-71139D55A7C5"
            },
            {
              "criteria": "cpe:2.3:h:dell:emc_idpa_dp5800:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "7FEEA32E-07CD-45F0-AB1E-235764A8A094"
            },
            {
              "criteria": "cpe:2.3:h:dell:emc_idpa_dp8300:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8C8B35A8-80BF-443E-992B-6F5B03A9928C"
            },
            {
              "criteria": "cpe:2.3:h:dell:emc_idpa_dp8800:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E98F97BD-57F5-4F2E-9573-863503A5B911"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}