Vulnerability · Published Jun 13, 2024 · Assigned by dell

CVE-2024-29168

Medium 5.4

In plain English

A medium-severity SQL injection in Secure Connect Gateway-Appliance from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.5%top 59.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Dell SCG, versions prior to 5.22.00.00, contain a SQL Injection Vulnerability in the SCG UI for an internal assets REST API. A remote authenticated attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend database causing potential unauthorized access and modification of application data.

Affected products (as reported)

Vendor	Product	Versions
Dell	Secure Connect Gateway-Application	5.18.00.20 – through 5.22.00.18
Dell	Secure Connect Gateway-Appliance	5.18.00.20 – through 5.22.00.18

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://www.dell.com/support/kbdoc/en-us/000225910/dsa-2024-181-security-update-for-dell-secure-connect-gateway-application-and-appliance-vulnerabilities vendor-advisory