CVE-2024-28969

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-28969", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "state": "PUBLISHED", "assignerShortName": "dell", "dateReserved": "2024-03-13T15:42:12.960Z", "datePublished": "2024-06-13T15:05:01.940Z", "dateUpdated": "2024-08-02T01:03:51.512Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Secure Connect Gateway-Application", "vendor": "Dell", "versions": [{"lessThanOrEqual": "5.22.00.18", "status": "affected", "version": "5.18.00.20", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Secure Connect Gateway-Appliance", "vendor": "Dell", "versions": [{"lessThanOrEqual": "5.22.00.18", "status": "affected", "version": "5.18.00.20", "versionType": "semver"}]}], "datePublic": "2024-06-10T06:30:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API (if enabled by Admin user from UI). A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain APIs applicable only for Admin Users on the application's backend database that could potentially allow an unauthorized user access to restricted resources."}], "value": "Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API (if enabled by Admin user from UI). A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain APIs applicable only for Admin Users on the application's backend database that could potentially allow an unauthorized user access to restricted resources."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2024-06-13T15:05:01.940Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000225910/dsa-2024-181-security-update-for-dell-secure-connect-gateway-application-and-appliance-vulnerabilities"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "dell", "product": "secure_connect_gateway_application", "cpes": ["cpe:2.3:a:dell:secure_connect_gateway_application:5.18.00.20:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "5.18.00.20", "status": "affected", "lessThanOrEqual": "5.22.00.18", "versionType": "custom"}]}, {"vendor": "dell", "product": "secure_connect_gateway_appliance", "cpes": ["cpe:2.3:a:dell:secure_connect_gateway_appliance:5.18.00.20:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "5.18.00.20", "status": "affected", "lessThanOrEqual": "5.22.00.18", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-14T16:13:44.960122Z", "id": "CVE-2024-28969", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-14T16:13:48.771Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:03:51.512Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://www.dell.com/support/kbdoc/en-us/000225910/dsa-2024-181-security-update-for-dell-secure-connect-gateway-application-and-appliance-vulnerabilities"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000225910/dsa-2024-181-security-update-for-dell-secure-connect-gateway-application-and-appliance-vulnerabilities", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:03:51.512Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-28969", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-14T16:13:44.960122Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:dell:secure_connect_gateway_application:5.18.00.20:*:*:*:*:*:*:*"], "vendor": "dell", "product": "secure_connect_gateway_application", "versions": [{"status": "affected", "version": "5.18.00.20", "versionType": "custom", "lessThanOrEqual": "5.22.00.18"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:dell:secure_connect_gateway_appliance:5.18.00.20:*:*:*:*:*:*:*"], "vendor": "dell", "product": "secure_connect_gateway_appliance", "versions": [{"status": "affected", "version": "5.18.00.20", "versionType": "custom", "lessThanOrEqual": "5.22.00.18"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-14T16:13:39.771Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dell", "product": "Secure Connect Gateway-Application", "versions": [{"status": "affected", "version": "5.18.00.20", "versionType": "semver", "lessThanOrEqual": "5.22.00.18"}], "defaultStatus": "unaffected"}, {"vendor": "Dell", "product": "Secure Connect Gateway-Appliance", "versions": [{"status": "affected", "version": "5.18.00.20", "versionType": "semver", "lessThanOrEqual": "5.22.00.18"}], "defaultStatus": "unaffected"}], "datePublic": "2024-06-10T06:30:00.000Z", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000225910/dsa-2024-181-security-update-for-dell-secure-connect-gateway-application-and-appliance-vulnerabilities", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API (if enabled by Admin user from UI). A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain APIs applicable only for Admin Users on the application's backend database that could potentially allow an unauthorized user access to restricted resources.", "supportingMedia": [{"type": "text/html", "value": "Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API (if enabled by Admin user from UI). A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain APIs applicable only for Admin Users on the application's backend database that could potentially allow an unauthorized user access to restricted resources.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2024-06-13T15:05:01.940Z"}}}, "cveMetadata": {"cveId": "CVE-2024-28969", "state": "PUBLISHED", "dateUpdated": "2024-08-02T01:03:51.512Z", "dateReserved": "2024-03-13T15:42:12.960Z", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "datePublished": "2024-06-13T15:05:01.940Z", "assignerShortName": "dell"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Secure Connect Gateway-Application", "vendor": "Dell", "versions": [{"lessThanOrEqual": "5.22.00.18", "status": "affected", "version": "5.18.00.20", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Secure Connect Gateway-Appliance", "vendor": "Dell", "versions": [{"lessThanOrEqual": "5.22.00.18", "status": "affected", "version": "5.18.00.20", "versionType": "semver"}]}], "source": "security_alert@emc.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:dell:secure_connect_gateway_application:5.18.00.20:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "secure_connect_gateway_application", "vendor": "dell", "versions": [{"lessThanOrEqual": "5.22.00.18", "status": "affected", "version": "5.18.00.20", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:dell:secure_connect_gateway_appliance:5.18.00.20:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "secure_connect_gateway_appliance", "vendor": "dell", "versions": [{"lessThanOrEqual": "5.22.00.18", "status": "affected", "version": "5.18.00.20", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:secure_connect_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "E22B308F-DD41-4598-81D0-5A10E43372DB", "versionEndIncluding": "5.22.00.18", "versionStartIncluding": "5.18.00.20", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API (if enabled by Admin user from UI). A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain APIs applicable only for Admin Users on the application's backend database that could potentially allow an unauthorized user access to restricted resources."}, {"lang": "es", "value": "Dell SCG, versiones anteriores a 5.24.00.00, contienen una vulnerabilidad de control de acceso inadecuado en el SCG expuesta para una API REST de actualizaci\u00f3n interna (si la habilita el usuario administrador desde la interfaz de usuario). Un atacante remoto con pocos privilegios podr\u00eda explotar esta vulnerabilidad, lo que llevar\u00eda a la ejecuci\u00f3n de ciertas API aplicables solo para usuarios administradores en la base de datos backend de la aplicaci\u00f3n que potencialmente podr\u00eda permitir que un usuario no autorizado acceda a recursos restringidos."}], "id": "CVE-2024-28969", "lastModified": "2026-06-17T07:22:10.680", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security_alert@emc.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-28969", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-06-14T16:13:44.960122Z", "version": "2.0.3"}}]}, "published": "2024-06-13T15:15:52.183", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000225910/dsa-2024-181-security-update-for-dell-secure-connect-gateway-application-and-appliance-vulnerabilities"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000225910/dsa-2024-181-security-update-for-dell-secure-connect-gateway-application-and-appliance-vulnerabilities"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security_alert@emc.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}