Exposure of Sensitive Information in Dell PowerProtect Data Manager

Executive Summary

Dell PowerProtect Data Manager before version 20.2.0.0 has a flaw where a highly privileged attacker with local access can exploit the REST API to expose sensitive information to unauthorized parties.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the version of Dell PowerProtect Data Manager. If it is prior to 20.2.0.0, the system is vulnerable. Use commands like 'rpm -qa | grep powerprotect' on Linux or check installed programs via Control Panel on Windows to verify the version.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain access to confidential data stored or processed by Dell PowerProtect Data Manager, potentially leading to data breaches or unauthorized information disclosure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to unauthorized exposure of sensitive personal or health data, resulting in legal penalties or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update Dell PowerProtect Data Manager to version 20.2.0.0 or later to address the vulnerability. Ensure only authorized users have local access to high-privilege accounts.

Useful 0 Not Useful 0