« Volver al listado

CVE-2023-39259

Estado: ModificadaAlta (7.8)—

Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. A local authenticated non-administrator user could potentially exploit this vulnerability, leading to the elevation of privilege on the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dell — OS Recovery Tool

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-39259",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-39259",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-12T14:11:30.942982Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security_alert@emc.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "Dell OS Recovery Tool",
          "versions": [
            {
              "status": "affected",
              "version": "Versions 2.3.7012.0, 2.2.4013, and 2.3.7515.0."
            }
          ],
          "platforms": [
            "SW"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-11-16T09:15:07.473",
  "references": [
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000217078/dsa-2023-319dsa-2023-319",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000217078/dsa-2023-319dsa-2023-319",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security_alert@emc.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "\nDell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. A local authenticated non-administrator user could potentially exploit this vulnerability, leading to the elevation of privilege on the system.\n\n"
    },
    {
      "lang": "es",
      "value": "Dell OS Recovery Tool en versiones 2.2.4013, 2.3.7012.0 y 2.3.7515.0, contienen una vulnerabilidad de control de acceso inadecuado. Un usuario local autenticado que no sea administrador podría explotar esta vulnerabilidad, lo que provocaría la elevación de privilegios en el sistema."
    }
  ],
  "lastModified": "2026-06-17T06:11:51.653",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:dell:os_recovery_tool:2.2.4013:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27D7466E-1ADC-4C9C-9AD8-77021108838F"
            },
            {
              "criteria": "cpe:2.3:o:dell:os_recovery_tool:2.3.7012.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "935BB4EC-A154-41EF-A7FB-7804081CF675"
            },
            {
              "criteria": "cpe:2.3:o:dell:os_recovery_tool:2.3.7515.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0CB25BEE-EED1-42F2-A32A-6D8E61C2967E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}