CVE-2024-22221

Vulnerability

Dell Unity, Dell Unity VSA, and Dell Unity XT versions prior to 5.4 contain a SQL injection vulnerability in an unspecified component. The vulnerability requires the attacker to be authenticated to the management interface. [1]

Exploitation

An authenticated attacker with network access to the Dell Unity management interface can exploit this vulnerability by injecting malicious SQL statements into vulnerable input fields. No user interaction is required beyond the initial authentication. [1]

Impact

Successful exploitation leads to exposure of sensitive information stored in the underlying database. The attacker gains read access to data that would otherwise be protected, potentially including configuration details, credentials, or other confidential data. [1]

Mitigation

Dell has released version 5.4 of Dell Unity, Dell Unity VSA, and Dell Unity XT to address this vulnerability. The fix was published on 2024-02-12. No workarounds are documented; upgrading to the fixed version is the recommended action. [1]