CVE-2024-37144

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-37144
Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to RCM 3.7.6.0 (for RCM 3.7.x train), Dell PowerFlex custom node using PowerFlex Manager versions prior to 4.6.1.0, Dell InsightIQ versions prior to 5.1.1, and Dell Data Lakehouse versions prior to 1.2.0.0 contain an Insecure Storage of Sensitive Information vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure. The attacker may be able to use information disclosed to gain unauthorized access to pods within the cluster.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://www.dell.com/support/kbdoc/en-us/000258342/dsa-2024-405-security-update-for-dell-products-for-multiple-vulnerabilities Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:dell:data_lakehouse:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:insightiq:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:powerflex_appliance_intelligent_catalog:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:powerflex_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:powerflex_rack_release_certification_matrix:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:powerflex_rack_release_certification_matrix:*:*:*:*:*:*:*:*
History

22 Jan 2026, 16:16

Type Values Removed Values Added
References () https://www.dell.com/support/kbdoc/en-us/000258342/dsa-2024-405-security-update-for-dell-products-for-multiple-vulnerabilities - () https://www.dell.com/support/kbdoc/en-us/000258342/dsa-2024-405-security-update-for-dell-products-for-multiple-vulnerabilities - Vendor Advisory
CPE cpe:2.3:a:dell:powerflex_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:powerflex_rack_release_certification_matrix:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:data_lakehouse:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:insightiq:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:powerflex_appliance_intelligent_catalog:*:*:*:*:*:*:*:*
First Time Dell insightiq
Dell powerflex Appliance Intelligent Catalog
Dell powerflex Rack Release Certification Matrix
Dell powerflex Manager
Dell data Lakehouse
Dell
Summary
  • (es) Las versiones del dispositivo Dell PowerFlex anteriores a IC 46.381.00 e IC 46.376.00, las versiones del rack Dell PowerFlex anteriores a RCM 3.8.1.0 (para el tren RCM 3.8.x) y anteriores a RCM 3.7.6.0 (para el tren RCM 3.7.x), el nodo personalizado Dell PowerFlex que utiliza versiones de PowerFlex Manager anteriores a 4.6.1.0, las versiones de Dell InsightIQ anteriores a 5.1.1 y las versiones de Dell Data Lakehouse anteriores a 1.2.0.0 contienen una vulnerabilidad de almacenamiento inseguro de información confidencial. Un atacante con privilegios elevados y acceso local podría explotar esta vulnerabilidad, lo que provocaría la divulgación de información. El atacante podría utilizar la información divulgada para obtener acceso no autorizado a los pods dentro del clúster.

10 Dec 2024, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-10 03:15

Updated : 2026-01-22 16:16

NVD link : CVE-2024-37144

Mitre link : CVE-2024-37144

CVE.ORG link : CVE-2024-37144

JSON object : View

Products Affected

dell

  • powerflex_rack_release_certification_matrix
  • data_lakehouse
  • insightiq
  • powerflex_appliance_intelligent_catalog
  • powerflex_manager
CWE
CWE-922

Insecure Storage of Sensitive Information