Vulnerability · Published Jan 25, 2024 · Assigned by dell
CVE-2024-22432
High 7.8
In plain English
A high-severity security flaw in NetWorker Module for Databases and Applications - Oracle from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups. User has low privilege access to Networker Client system could potentially exploit this vulnerability, leading to the disclosure of configured MySQL Database user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application Database with privileges of the compromised account.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Dell | NetWorker Module for Databases and Applications - Oracle | 19.9 – through 19.9.0.319.8 – through 19.8.0.419.7 – through 19.7.0.519.7.10 – before 19.7 |
Weakness: CWE-256 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H