CVE-2024-37144

Estado: AnalizadaMedia (6.7)—

Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to RCM 3.7.6.0 (for RCM 3.7.x train), Dell PowerFlex custom node using PowerFlex Manager versions prior to 4.6.1.0, Dell InsightIQ versions prior to 5.1.1, and Dell Data Lakehouse versions prior to 1.2.0.0 contain an Insecure Storage of Sensitive Information vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure. The attacker may be able to use information disclosed to gain unauthorized access to pods within the cluster.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 6.7

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.17%
Percentil entre todas las CVEs puntuadas: 6
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Dell — Data Lakehouse Dell — Insightiq Dell — Powerflex Appliance Intelligent Catalog Dell — Powerflex Manager Dell — Powerflex Rack Release Certification Matrix

CWE

CWE-922

Referencias

https://www.dell.com/support/kbdoc/en-us/000258342/dsa-2024-405-security-update-for-dell-products-for-multiple-vulnerabilities

JSON original (NVD)

Mostrar

{
  "id": "CVE-2024-37144",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-37144",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-10T21:27:12.499475Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security_alert@emc.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "Dell PowerFlex appliance",
          "versions": [
            {
              "status": "affected",
              "version": "N/A",
              "lessThan": "46.381.00",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "N/A",
              "lessThan": "46.376.00",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Dell",
          "product": "Dell PowerFlex rack",
          "versions": [
            {
              "status": "affected",
              "version": "N/A",
              "lessThan": "3.8.1.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "N/A",
              "lessThan": "3.7.6.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Dell",
          "product": "Dell PowerFlex custom node",
          "versions": [
            {
              "status": "affected",
              "version": "N/A",
              "lessThan": "4.6.1.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Dell",
          "product": "Dell InsightIQ",
          "versions": [
            {
              "status": "affected",
              "version": "N/A",
              "lessThan": "5.1.1",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Dell",
          "product": "Dell Data Lakehouse",
          "versions": [
            {
              "status": "affected",
              "version": "N/A",
              "lessThan": "1.2.0.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-12-10T03:15:05.730",
  "references": [
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000258342/dsa-2024-405-security-update-for-dell-products-for-multiple-vulnerabilities",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security_alert@emc.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-922"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to RCM 3.7.6.0 (for RCM 3.7.x train), Dell PowerFlex custom node using PowerFlex Manager versions prior to 4.6.1.0, Dell InsightIQ versions prior to 5.1.1, and Dell Data Lakehouse versions prior to 1.2.0.0 contain an Insecure Storage of Sensitive Information vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure. The attacker may be able to use information disclosed to gain unauthorized access to pods within the cluster."
    },
    {
      "lang": "es",
      "value": "Las versiones del dispositivo Dell PowerFlex anteriores a IC 46.381.00 e IC 46.376.00, las versiones del rack Dell PowerFlex anteriores a RCM 3.8.1.0 (para el tren RCM 3.8.x) y anteriores a RCM 3.7.6.0 (para el tren RCM 3.7.x), el nodo personalizado Dell PowerFlex que utiliza versiones de PowerFlex Manager anteriores a 4.6.1.0, las versiones de Dell InsightIQ anteriores a 5.1.1 y las versiones de Dell Data Lakehouse anteriores a 1.2.0.0 contienen una vulnerabilidad de almacenamiento inseguro de información confidencial. Un atacante con privilegios elevados y acceso local podría explotar esta vulnerabilidad, lo que provocaría la divulgación de información. El atacante podría utilizar la información divulgada para obtener acceso no autorizado a los pods dentro del clúster."
    }
  ],
  "lastModified": "2026-06-17T07:37:50.190",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dell:data_lakehouse:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80278A58-A1BB-4CD1-93B7-2BEC2D227FCC",
              "versionEndExcluding": "1.2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:dell:insightiq:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0544C44D-29E4-45AB-A12B-B05F0A2ECC14",
              "versionEndExcluding": "5.1.1"
            },
            {
              "criteria": "cpe:2.3:a:dell:powerflex_appliance_intelligent_catalog:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "680FAFDC-0CF1-4B01-B0AF-6775389B33A4",
              "versionEndExcluding": "46.376.00"
            },
            {
              "criteria": "cpe:2.3:a:dell:powerflex_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44B7F933-3F65-4B22-9EC6-323B4ED600A1",
              "versionEndExcluding": "4.6.1.0"
            },
            {
              "criteria": "cpe:2.3:a:dell:powerflex_rack_release_certification_matrix:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "427C3C57-3812-4951-A6F6-2D598391B633",
              "versionEndExcluding": "3.7.6.0",
              "versionStartIncluding": "3.7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:dell:powerflex_rack_release_certification_matrix:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF3A561D-15B4-47E4-B578-F21DA37D3830",
              "versionEndExcluding": "3.8.1.0",
              "versionStartIncluding": "3.8.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}