CVE-2024-37142

Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and escalation of privilege

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000225474/dsa-2024-242	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dell:peripheral_manager:*:*:*:*:*:*:*:*

History

08 Aug 2024, 21:17

Type	Values Removed	Values Added
CPE		cpe:2.3:a:dell:peripheral_manager::::::::
References	~~() https://www.dell.com/support/kbdoc/en-us/000225474/dsa-2024-242 -~~	() https://www.dell.com/support/kbdoc/en-us/000225474/dsa-2024-242 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~7.3~~	v2 : unknown v3 : 7.8
First Time		Dell peripheral Manager Dell

31 Jul 2024, 12:57

Type	Values Removed	Values Added
Summary		(es) Dell Peripheral Manager, versiones anteriores a 1.7.6, contiene una vulnerabilidad de elemento de ruta de búsqueda no controlada. Un atacante podría explotar esta vulnerabilidad mediante la precarga de una DLL maliciosa o la explotación de enlaces simbólicos, lo que lleva a la ejecución de código arbitrario y la escalada de privilegios.

31 Jul 2024, 09:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-31 09:15

Updated : 2024-08-08 21:17

NVD link : CVE-2024-37142

Mitre link : CVE-2024-37142

CVE.ORG link : CVE-2024-37142

JSON object : View

Products Affected

dell

peripheral_manager

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2024-37142", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}]}, "published": "2024-07-31T09:15:04.700", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000225474/dsa-2024-242", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and escalation of privilege"}, {"lang": "es", "value": "Dell Peripheral Manager, versiones anteriores a 1.7.6, contiene una vulnerabilidad de elemento de ruta de b\u00fasqueda no controlada. Un atacante podr\u00eda explotar esta vulnerabilidad mediante la precarga de una DLL maliciosa o la explotaci\u00f3n de enlaces simb\u00f3licos, lo que lleva a la ejecuci\u00f3n de c\u00f3digo arbitrario y la escalada de privilegios."}], "lastModified": "2024-08-08T21:17:18.647", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:peripheral_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "99B6BBE4-2845-44DA-BC9D-C80FB9537457", "versionEndExcluding": "1.7.6"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}