Vulnerability-Lookup

VAR-202312-0860

Vulnerability from variot - Updated: 2025-02-07 23:15

Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an SQL Injection vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend database causing unauthorized read access to application data. Dell PowerProtect Data Domain (Dell PowerProtect DD) is a set of hardware devices for data protection, backup, storage and deduplication from Dell (Dell).

Dell PowerProtect Data Domain has a SQL injection vulnerability, which is caused by the lack of validation of external input SQL statements

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202312-0860",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "emc data domain os",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "dell",
        "version": "7.0"
      },
      {
        "model": "powerprotect data domain",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "dell",
        "version": "7.0"
      },
      {
        "model": "powerprotect data domain management center",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "dell",
        "version": "7.0"
      },
      {
        "model": "powerprotect data domain",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "7.12.0.0"
      },
      {
        "model": "powerprotect data domain management center",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "7.10.1.15"
      },
      {
        "model": "emc data domain os",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "7.10.1.15"
      },
      {
        "model": "emc data domain os",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "7.12.0.0"
      },
      {
        "model": "powerprotect data domain management center",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "7.7.5.25"
      },
      {
        "model": "powerprotect data domain management center",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "dell",
        "version": "7.10"
      },
      {
        "model": "apex protection storage",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "7.10.1.15"
      },
      {
        "model": "emc data domain os",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "7.7.5.25"
      },
      {
        "model": "emc data domain os",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "dell",
        "version": "7.10"
      },
      {
        "model": "powerprotect data protection",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "2.7.6"
      },
      {
        "model": "powerprotect data domain management center",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "dell",
        "version": "7.7"
      },
      {
        "model": "emc data domain os",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "dell",
        "version": "7.7"
      },
      {
        "model": "powerprotect data domain management center",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "7.13.0.10"
      },
      {
        "model": "powerprotect data domain management center",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "6.2.1.110"
      },
      {
        "model": "emc data domain os",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "6.2.1.110"
      },
      {
        "model": "powerprotect data domain",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "6.2.1.110"
      },
      {
        "model": "apex protection storage",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "dell",
        "version": "7.0"
      },
      {
        "model": "apex protection storage",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "dell",
        "version": "6.2.1.110"
      },
      {
        "model": "powerprotect data domain",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "dell",
        "version": "7.13.0.10"
      },
      {
        "model": "powerprotect data domain \u003clts",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "dell",
        "version": "7.7.5.25"
      },
      {
        "model": "powerprotect data domain \u003clts",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "dell",
        "version": "7.10.1.15"
      },
      {
        "model": "powerprotect data domain",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "dell",
        "version": "6.2.1.110"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-02570"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-44284"
      }
    ]
  },
  "cve": "CVE-2023-44284",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.0,
            "id": "CNVD-2025-02570",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.8,
            "id": "CVE-2023-44284",
            "impactScore": 1.4,
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2023-44284",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "security_alert@emc.com",
            "id": "CVE-2023-44284",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2025-02570",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-02570"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-44284"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-44284"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "\nDell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an SQL Injection vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application\u0027s backend database causing unauthorized read access to application data. Dell PowerProtect Data Domain (Dell PowerProtect DD) is a set of hardware devices for data protection, backup, storage and deduplication from Dell (Dell). \n\nDell PowerProtect Data Domain has a SQL injection vulnerability, which is caused by the lack of validation of external input SQL statements",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2023-44284"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2025-02570"
      }
    ],
    "trust": 1.44
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2023-44284",
        "trust": 1.6
      },
      {
        "db": "CNVD",
        "id": "CNVD-2025-02570",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-02570"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-44284"
      }
    ]
  },
  "id": "VAR-202312-0860",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-02570"
      }
    ],
    "trust": 0.06
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-02570"
      }
    ]
  },
  "last_update_date": "2025-02-07T23:15:38.545000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Patch for Dell PowerProtect Data Domain SQL Injection Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/652866"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-02570"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-89",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2023-44284"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.0,
        "url": "https://www.dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities"
      },
      {
        "trust": 0.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2023-44284"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-02570"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-44284"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-02570"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-44284"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2024-01-22T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2025-02570"
      },
      {
        "date": "2023-12-14T16:15:46.880000",
        "db": "NVD",
        "id": "CVE-2023-44284"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2025-02-06T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2025-02570"
      },
      {
        "date": "2023-12-27T19:31:19.403000",
        "db": "NVD",
        "id": "CVE-2023-44284"
      }
    ]
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Dell PowerProtect Data Domain SQL Injection Vulnerability",
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2025-02570"
      }
    ],
    "trust": 0.6
  }
}

CVE-2023-44284 (GCVE-0-2023-44284)

Vulnerability from cvelistv5 – Published: 2023-12-14 15:26 – Updated: 2024-11-21 16:20

Summary

Severity ?

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

dell

References

URL

Tags

https://www.dell.com/support/kbdoc/en-us/00022026…

vendor-advisory

Impacted products

	Vendor	Product	Version
	Dell	PowerProtect DD	Affected: Versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110

Credits

Dell Technologies would like to thank Jakub Brzozowski (redfr0g), Franciszek Kalinowski, and Stanisław Koza from STM Cyber for reporting these issues.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:59:51.944Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-44284",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-21T16:19:54.936040Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-21T16:20:17.129Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PowerProtect DD",
          "vendor": "Dell",
          "versions": [
            {
              "status": "affected",
              "version": "Versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Dell Technologies would like to thank Jakub Brzozowski (redfr0g), Franciszek Kalinowski, and Stanis\u0142aw Koza from STM Cyber for reporting these issues. "
        }
      ],
      "datePublic": "2023-12-13T06:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an SQL Injection vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application\u0027s backend database causing unauthorized read access to application data. \u003c/span\u003e\n\n"
            }
          ],
          "value": "\nDell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an SQL Injection vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application\u0027s backend database causing unauthorized read access to application data. \n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-14T15:26:43.251Z",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2023-44284",
    "datePublished": "2023-12-14T15:26:43.251Z",
    "dateReserved": "2023-09-28T09:25:45.714Z",
    "dateUpdated": "2024-11-21T16:20:17.129Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-202312-0860

CVE-2023-44284 (GCVE-0-2023-44284)

Tags

Sightings

Nomenclature