CVE-2017-14374
Quick assessment
Affected
n/a Dell Storage Manager 2016 Dell Storage Manager versions earlier than 16.3.20
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Dell Storage Manager是美国戴尔（Dell）公司的一款用于管理和监控多个Storage Center、PS系列组合FluidFS的应用程序。 Dell Storage Manager 16.3.20之前的版本(又名2016 R3.20)中存在安全漏洞，该漏洞源于程序使用了硬编码密码保护SMI-S服务。攻击者可通过发送HTTP请求利用该漏洞禁用SMI-S服务。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2017-14374
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 (aka 2016 R3.20) is protected using a hard-coded password. A remote user with the knowledge of the password might potentially disable the SMI-S service via HTTP requests, affecting storage management and monitoring functionality via the SMI-S interface. This issue, aka DSM-30415, only affects a Windows installation of the Data Collector (not applicable to the virtual appliance).
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Dell Storage Manager 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Dell Storage Manager是美国戴尔（Dell）公司的一款用于管理和监控多个Storage Center、PS系列组合FluidFS的应用程序。 Dell Storage Manager 16.3.20之前的版本(又名2016 R3.20)中存在安全漏洞，该漏洞源于程序使用了硬编码密码保护SMI-S服务。攻击者可通过发送HTTP请求利用该漏洞禁用SMI-S服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | Dell Storage Manager 2016 Dell Storage Manager versions earlier than 16.3.20 | Dell Storage Manager 2016 Dell Storage Manager versions earlier than 16.3.20 | - |
|
II. Public POCs for CVE-2017-14374
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2017-14374
请登录查看更多情报信息。
Other References for CVE-2017-14374 (1)
-
http://topics-cdn.dell.com/pdf/storage-sc2000_release%20notes24_en-us.pdf x_refsource_CONFIRM
Same Patch Batch · n/a · 2017-12-06 · 13 CVEs total
| CVE-2017-17068 | Auth0 auth0.js library 安全漏洞 | |
| CVE-2017-17446 | Game_Music_Emu library 安全漏洞 | |
| CVE-2017-17440 | GNU Libextractor 安全漏洞 | |
| CVE-2017-16884 | MistServer 跨站脚本漏洞 | |
| CVE-2017-17055 | Artica Web Proxy 跨站脚本漏洞 | |
| CVE-2017-17381 | QEMU 安全漏洞 | |
| CVE-2017-17439 | Heimdal 安全漏洞 | |
| CVE-2017-17069 | Amazon Audible for Windows 安全漏洞 | |
| CVE-2017-17383 | CloudBees Jenkins 跨站脚本漏洞 | |
| CVE-2017-17433 | rsync 安全漏洞 | |
| CVE-2017-17434 | rsync 安全漏洞 | |
| CVE-2017-17432 | OpenAFS 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2017-14374
No comments yet