Vulnerability · Published Nov 23, 2021 · Assigned by dell

CVE-2021-36299

High 7.1

In plain English

A high-severity SQL injection in Integrated Dell Remote Access Controller (iDRAC) from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 29.6% (higher than 98% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)29.6%top 1.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to the affected application.

Affected products (as reported)

Vendor	Product	Versions
Dell	Integrated Dell Remote Access Controller (iDRAC)	unspecified – before 5.00.00.00

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

References

https://support.emc.com/kb/000191229 x_refsource_MISC