CVE-2022-33925

Vulnerability

CVE-2022-33925 is an improper access control vulnerability in the UI component of Dell Wyse Management Suite versions 3.6.1 and below [1]. The vulnerability allows an authenticated remote attacker to bypass intended access controls and download reports that contain sensitive information [1].

Exploitation

An attacker must have valid low-privilege authentication to the Wyse Management Suite web interface [1]. No additional privileges are needed; the attacker can directly access the report download functionality that should be restricted [1]. The attack is network-based with low complexity and does not require user interaction [1].

Impact

Successful exploitation leads to unauthorized disclosure of sensitive information contained in reports [1]. The CVSS vector indicates a high impact on confidentiality (C:H) with no impact on integrity or availability (I:N/A:N), resulting in a base score of 6.5 [1].

Mitigation

Dell released Wyse Management Suite version 3.7 to address this vulnerability; users should upgrade to 3.7 or later [1]. No workaround is documented in the available references [1].