CVE-2022-33926

Vulnerability

Dell Wyse Management Suite versions 3.7 and earlier contain an improper access control vulnerability in the file repository. A remote authenticated attacker with low privileges can exploit this to retain access to a file repository even after their access has been revoked. [1]

Exploitation

An attacker must be authenticated to the Wyse Management Suite with low privileges. No user interaction is required. The attacker can exploit the improper access control to continue accessing the file repository after revocation. The CVSS vector indicates network access with low complexity. [1]

Impact

Successful exploitation allows the attacker to retain access to the file repository, leading to potential modification of files (high integrity impact) and limited information disclosure (low confidentiality impact). The availability is not affected. The CVSS base score is 7.1. [1]

Mitigation

Dell has released a security update (DSA-2022-134) to address this vulnerability. Affected users should update to a fixed version of Wyse Management Suite. No workarounds are documented. [1]