CVE-2023-48661 Path traversal in vApp Manager
A remote attacker with high privileges can read arbitrary files from the target system via an arbitrary file read vulnerability in Dell vApp Manager.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-48661?
CVE-2023-48661 is a medium-severity path traversal vulnerability in Dell vApp Manager, published on 14 Dec 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Dell vApp Manager, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability to read arbitrary files from the target system.
Weakness: CWE-552
Which versions are affected by CVE-2023-48661?
It affects 3 products.
Products include Dell Powermax Os, Dell Solutions Enabler Virtual Appliance, Dell Unisphere for Powermax Virtual Appliance.
How do I fix CVE-2023-48661?
No fix has been published for CVE-2023-48661 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-48661 being exploited?
There is no known exploitation of CVE-2023-48661 in the wild and no public exploit code.
Other vulnerabilities in Dell vApp Manager
Sources
Also known as GHSA-529r-wppw-c5ch.