Vulnerability-Lookup

CNVD-2021-02366

Vulnerability from cnvd - Published: 2021-01-13

Title

Dell Wyse Management Suite开放重定向漏洞

Description

Dell Wyse Management Suite是下一代管理解决方案，使您能够集中配置、监控、管理和优化Dell Wyse瘦客户端。 Dell Wyse Management Suite 3.1之前版本存在开放重定向漏洞。攻击者可通过诱使用户点击恶意链接利用该漏洞将用户重定向到任意Web URL。

Severity

中

Patch Name

Dell Wyse Management Suite开放重定向漏洞的补丁

Patch Description

Dell Wyse Management Suite是下一代管理解决方案，使您能够集中配置、监控、管理和优化Dell Wyse瘦客户端。 Dell Wyse Management Suite 3.1之前版本存在开放重定向漏洞。攻击者可通过诱使用户点击恶意链接利用该漏洞将用户重定向到任意Web URL。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.dell.com/support/kbdoc/zh-cn/000180983/dsa-2020-282

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-29498

Impacted products

Name
Dell Wyse Management Suite（WMS） <3.1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-29498",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-29498"
    }
  },
  "description": "Dell Wyse Management Suite\u662f\u4e0b\u4e00\u4ee3\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\uff0c\u4f7f\u60a8\u80fd\u591f\u96c6\u4e2d\u914d\u7f6e\u3001\u76d1\u63a7\u3001\u7ba1\u7406\u548c\u4f18\u5316Dell Wyse\u7626\u5ba2\u6237\u7aef\u3002\n\nDell Wyse Management Suite 3.1\u4e4b\u524d\u7248\u672c\u5b58\u5728\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u8bf1\u4f7f\u7528\u6237\u70b9\u51fb\u6076\u610f\u94fe\u63a5\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u7528\u6237\u91cd\u5b9a\u5411\u5230\u4efb\u610fWeb URL\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.dell.com/support/kbdoc/zh-cn/000180983/dsa-2020-282",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-02366",
  "openTime": "2021-01-13",
  "patchDescription": "Dell Wyse Management Suite\u662f\u4e0b\u4e00\u4ee3\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\uff0c\u4f7f\u60a8\u80fd\u591f\u96c6\u4e2d\u914d\u7f6e\u3001\u76d1\u63a7\u3001\u7ba1\u7406\u548c\u4f18\u5316Dell Wyse\u7626\u5ba2\u6237\u7aef\u3002\r\n\r\nDell Wyse Management Suite 3.1\u4e4b\u524d\u7248\u672c\u5b58\u5728\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u8bf1\u4f7f\u7528\u6237\u70b9\u51fb\u6076\u610f\u94fe\u63a5\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u7528\u6237\u91cd\u5b9a\u5411\u5230\u4efb\u610fWeb URL\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Dell Wyse Management Suite\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Dell Wyse Management Suite\uff08WMS\uff09 \u003c3.1"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-29498",
  "serverity": "\u4e2d",
  "submitTime": "2021-01-05",
  "title": "Dell Wyse Management Suite\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e"
}

CVE-2020-29498 (GCVE-0-2020-29498)

Vulnerability from cvelistv5 – Published: 2021-01-04 21:15 – Updated: 2024-09-17 02:57

Summary

Dell Wyse Management Suite versions prior to 3.1 contain an open redirect vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites.

Severity ?

6.1 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

dell

References

URL

Tags

https://www.dell.com/support/kbdoc/en-us/00018098…

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Dell	Wyse Management Suite	Affected: unspecified , < 3.1 (custom)

Date Public ?

2020-12-18 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:55:10.496Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/kbdoc/en-us/000180983/dsa-2020-282"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Wyse Management Suite",
          "vendor": "Dell",
          "versions": [
            {
              "lessThan": "3.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2020-12-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Dell Wyse Management Suite versions prior to 3.1 contain an open redirect vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-04T21:15:21.000Z",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/kbdoc/en-us/000180983/dsa-2020-282"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@dell.com",
          "DATE_PUBLIC": "2020-12-18",
          "ID": "CVE-2020-29498",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Wyse Management Suite",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "3.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Dell"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Dell Wyse Management Suite versions prior to 3.1 contain an open redirect vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": 6.1,
            "baseSeverity": "Medium",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.dell.com/support/kbdoc/en-us/000180983/dsa-2020-282",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/kbdoc/en-us/000180983/dsa-2020-282"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2020-29498",
    "datePublished": "2021-01-04T21:15:21.584Z",
    "dateReserved": "2020-12-03T00:00:00.000Z",
    "dateUpdated": "2024-09-17T02:57:03.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-02366

CVE-2020-29498 (GCVE-0-2020-29498)

Tags

Sightings

Nomenclature