CVE-2022-46755

Vulnerability

Wyse Management Suite versions 3.8 and below contain an improper access control vulnerability [1]. An authenticated malicious end user can edit general client policy for which they are not authorized [1].

Exploitation

The attacker must have valid credentials with privileged access (high privileges) to the Wyse Management Suite [1]. The vulnerability can be exploited remotely over the network without user interaction [1]. The attacker can exploit the flaw by manipulating policy editing functions to bypass authorization checks.

Impact

Successful exploitation allows the attacker to edit client policies they are not authorized to modify, leading to a denial of service (availability impact) as per CVSS vector [1]. The impact is limited to availability; no confidentiality or integrity impact is reported [1].

Mitigation

Dell has released a security update for Wyse Management Suite. Refer to DSA-2022-329 [1] for fixed version details. Users should apply the update to remediate the vulnerability.