CVE-2022-33930

Vulnerability

Dell Wyse Management Suite versions 3.6.1 and below contain an information disclosure vulnerability in the Devices error pages. The error pages may inadvertently expose sensitive information to an attacker without proper authentication.

Exploitation

An attacker with network access to the Wyse Management Suite can trigger error pages by sending crafted requests. No special privileges are required, as the error pages are accessible without authentication. By analyzing the error page content, the attacker can extract sensitive data.

Impact

Successful exploitation results in the disclosure of sensitive information, which could include configuration details, internal paths, or user data. This information can be leveraged for further attacks, such as privilege escalation or additional vulnerability research.

Mitigation

Dell has released a security advisory (DSA-2022-134) addressing multiple vulnerabilities, including CVE-2022-33930. Users should upgrade to Wyse Management Suite version 3.7 or later, which contains the fix. No workarounds are documented; upgrading is the recommended mitigation [1].