CVE-2019-3707 WS-MAN Authentication Bypass Vulnerability
Remote attackers can bypass authentication on Dell iDRAC9 via the WS-MAN interface to gain unauthorized system access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3707?
CVE-2019-3707 is a high-severity authentication bypass vulnerability in Dell EMC iDRAC, published on 26 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dell EMC iDRAC9 versions prior to 3.30.30.30 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this vulnerability to bypass authentication and gain access to the system by sending specially crafted input data to the WS-MAN interface.
Which versions are affected by CVE-2019-3707?
It affects 1 product.
Products include Dell Idrac9 Firmware.
How do I fix CVE-2019-3707?
No fix has been published for CVE-2019-3707 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-3707 being exploited?
There is no known exploitation of CVE-2019-3707 in the wild and no public exploit code.
Other vulnerabilities in Dell EMC iDRAC
- CVE-2021-21538 Auth bypass in Integrated Dell Remote Access Controller (iDRAC)
- CVE-2019-3706 Web Interface Authentication Bypass Vulnerability
- CVE-2020-5366 Path traversal in Integrated Dell Remote Access Controller (iDRAC)
- CVE-2018-1249 Security feature bypass in iDRAC9
- CVE-2021-21541 Cross-site scripting in Integrated Dell Remote Access Controller (iDRAC)
Sources
Also known as GHSA-hhjr-5h5v-4hr4.