CVE-2019-3746CWE-307

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API

Critical · published September 27, 2019

CVSS v3.0
9.8
EPSS
2%
Percentile
81.7
In the wild
Unconfirmed
What it is

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote user may exploit this vulnerability to launch a brute-force authentication attack in order to gain access to the system.

The record
Technical detail
CVSS v3.0
9.8 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02121 · 81.7th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2019-09-27T20:20Z
EPSS history
Timeline
  • 27 SEP 20:20Z
    Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API
    cvelistv5