« Volver al listado

CVE-2024-29169

Estado: AnalizadaAlta (8.1)—

Dell SCG, versions prior to 5.22.00.00, contain a SQL Injection Vulnerability in the SCG UI for an internal audit REST API. A remote authenticated attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend database causing potential unauthorized access and modification of application data.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dell — Secure Connect Gateway

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-29169",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-29169",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-13T18:34:34.111147Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security_alert@emc.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "Secure Connect Gateway-Application",
          "versions": [
            {
              "status": "affected",
              "version": "5.18.00.20",
              "versionType": "semver",
              "lessThanOrEqual": "5.22.00.18"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Dell",
          "product": "Secure Connect Gateway-Appliance",
          "versions": [
            {
              "status": "affected",
              "version": "5.18.00.20",
              "versionType": "semver",
              "lessThanOrEqual": "5.22.00.18"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:dell:secure_connect_gateway_application:5.18.00.20:*:*:*:*:*:*:*"
          ],
          "vendor": "dell",
          "product": "secure_connect_gateway_application",
          "versions": [
            {
              "status": "affected",
              "version": "5.18.00.20",
              "versionType": "custom",
              "lessThanOrEqual": "5.22.00.18"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:dell:secure_connect_gateway_appliance:5.18.00.20:*:*:*:*:*:*:*"
          ],
          "vendor": "dell",
          "product": "secure_connect_gateway_appliance",
          "versions": [
            {
              "status": "affected",
              "version": "5.18.00.20",
              "versionType": "custom",
              "lessThanOrEqual": "5.22.00.18"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-06-13T16:15:10.610",
  "references": [
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000225910/dsa-2024-181-security-update-for-dell-secure-connect-gateway-application-and-appliance-vulnerabilities",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000225910/dsa-2024-181-security-update-for-dell-secure-connect-gateway-application-and-appliance-vulnerabilities",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security_alert@emc.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dell SCG, versions prior to 5.22.00.00, contain a SQL Injection Vulnerability in the SCG UI for an internal audit REST API. A remote authenticated attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend database causing potential unauthorized access and modification of application data."
    },
    {
      "lang": "es",
      "value": "Dell SCG, versiones anteriores a 5.22.00.00, contienen una vulnerabilidad de inyección SQL en la interfaz de usuario de SCG para una API REST de auditoría interna. Un atacante autenticado remoto podría explotar esta vulnerabilidad, lo que llevaría a la ejecución de ciertos comandos SQL en la base de datos backend de la aplicación, lo que provocaría un posible acceso no autorizado y modificación de los datos de la aplicación."
    }
  ],
  "lastModified": "2026-06-17T07:22:33.120",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dell:secure_connect_gateway:*:*:*:*:application:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ADFA500B-991B-462F-B3D7-43B7E94507F4",
              "versionEndExcluding": "5.24.00.14",
              "versionStartIncluding": "5.18.00.20"
            },
            {
              "criteria": "cpe:2.3:a:dell:secure_connect_gateway:*:*:*:*:virtual:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6BF621F9-4F96-43CA-9418-48CE2B08D2AD",
              "versionEndExcluding": "5.24.00.14",
              "versionStartIncluding": "5.18.00.20"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}