CVE-2019-3746 Auth bypass in Integrated Data Protection Appliance
An authenticated remote user can brute-force the ACM API due to missing rate limiting, potentially gaining unauthorized system access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3746?
CVE-2019-3746 is a critical authentication bypass vulnerability in Dell Integrated Data Protection Appliance, published on 27 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote user may exploit this vulnerability to launch a brute-force authentication attack in order to gain access to the system.
Weakness: CWE-307
Which versions are affected by CVE-2019-3746?
It affects 1 product.
Products include Dell Emc Integrated Data Protection Appliance Firmware.
How do I fix CVE-2019-3746?
No fix has been published for CVE-2019-3746 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-3746 being exploited?
There is no known exploitation of CVE-2019-3746 in the wild and no public exploit code.
Other vulnerabilities in Dell Integrated Data Protection Appliance
Sources
Also known as GHSA-3q4q-6vxp-x66f.