CVE-2019-3750

MEDIUM

5.5

Description

Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A local authenticated malicious user with low privileges potentially could exploit this vulnerability to delete arbitrary files by creating a symlink from the "Temp\IC\ICDebugLog.txt" to any targeted file. This issue occurs because of insecure handling of Temp directory permissions that were set incorrectly.

CVE Details

CVSS v3.1 Score5.5

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack VectorLOCAL

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published12/3/2019

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

dell:command_update

Weaknesses (CWE)

CWE-427CWE-59

References

https://www.dell.com/support/article/SLN319697(security_alert@emc.com)

https://www.dell.com/support/article/SLN319697(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.