CVE-2024-52538

Vulnerability

Dell Avamar versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contain an improper neutralization of special elements used in an SQL command (SQL injection) vulnerability [1]. This flaw exists in the application's handling of user-supplied input, allowing an attacker to inject malicious SQL queries through vulnerable parameters.

Exploitation

An attacker with low privileges and remote network access can exploit this vulnerability by sending crafted input to the affected component [1]. No user interaction is required. The attacker can manipulate SQL queries to inject script content, potentially leading to script injection within the application context.

Impact

Successful exploitation results in script injection, which can lead to high confidentiality impact (information disclosure), low integrity impact, and low availability impact [1]. The attacker may be able to execute arbitrary scripts in the context of the application, potentially accessing sensitive data or performing unauthorized actions.

Mitigation

Dell has released patches to address this vulnerability: upgrade to Avamar 19.12 with patch 338905, or to 19.10 or 19.10SP1 with patch 338869 [1]. No workarounds are available. Users should apply the patches as soon as possible.