« Volver al listado

CVE-2025-21117

Estado: AnalizadaMedia (5.5)—

Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI. A low privileged local attacker could potentially exploit this vulnerability, leading to fully impersonating the user.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dell — Avamar Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-21117",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-21117",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-05T13:55:27.569265Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security_alert@emc.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.6,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "Avamar",
          "versions": [
            {
              "status": "affected",
              "version": "19.4"
            },
            {
              "status": "affected",
              "version": "19.7"
            },
            {
              "status": "affected",
              "version": "19.8"
            },
            {
              "status": "affected",
              "version": "19.9"
            },
            {
              "status": "affected",
              "version": "19.10"
            },
            {
              "status": "affected",
              "version": "19.10 SP1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-02-05T14:15:27.417",
  "references": [
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000281275/dsa-2025-071-security-update-for-dell-avamar-for-multiple-component-vulnerabilities",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security_alert@emc.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-672"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI. A low privileged local attacker could potentially exploit this vulnerability, leading to fully impersonating the user."
    },
    {
      "lang": "es",
      "value": "Dell Avamar, versión 19.4 o posterior, contiene una vulnerabilidad de reutilización de token de acceso en la interfaz de usuario de autenticación. Un atacante local con pocos privilegios podría aprovechar esta vulnerabilidad y suplantar por completo la identidad del usuario."
    }
  ],
  "lastModified": "2026-06-17T08:42:37.643",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dell:avamar_server:19.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A19DD36F-1EE9-4FBF-9968-DF270C5FD1C4"
            },
            {
              "criteria": "cpe:2.3:a:dell:avamar_server:19.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D8C50D2C-B787-4366-AAED-057F9439A6A5"
            },
            {
              "criteria": "cpe:2.3:a:dell:avamar_server:19.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41028ABC-C574-42AE-897B-E1C65CD0D0BB"
            },
            {
              "criteria": "cpe:2.3:a:dell:avamar_server:19.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B1D9257-AA6C-4D68-B209-E72128A017D1"
            },
            {
              "criteria": "cpe:2.3:a:dell:avamar_server:19.10:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7ADB97BD-3E80-439D-950C-93EF391DDA8F"
            },
            {
              "criteria": "cpe:2.3:a:dell:avamar_server:19.10:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D0075FDA-26E4-4687-9D94-21283E2B5028"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}