CVE-2024-22464 Information disclosure in AppSync
A high-privileged remote attacker can read sensitive user credentials from AppSync server logs, potentially leading to unauthorized system access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-22464?
CVE-2024-22464 is a medium-severity vulnerability in Dell AppSync, published on 8 Feb 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Dell EMC AppSync, versions from 4.2.0.0 to 4.6.0.0 including all Service Pack releases, contain an exposure of sensitive information vulnerability in AppSync server logs. A high privileged remote attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable system with privileges of the compromised account.
Weakness: CWE-532
Which versions are affected by CVE-2024-22464?
It affects 1 product.
Products include Dell Emc Appsync.
How do I fix CVE-2024-22464?
No fix has been published for CVE-2024-22464 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-22464 being exploited?
There is no known exploitation of CVE-2024-22464 in the wild and no public exploit code.
Other vulnerabilities in Dell AppSync
Sources
Also known as GHSA-55g3-3qvv-89r4.