CVE-2024-38485
Quick assessment
Affected
Dell ECS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Dell ECS是美国戴尔（Dell）公司的一款可扩展、易于管理且具有弹性的企业级对象存储解决方案。 Dell ECS 3.8.0版本之前存在输入验证错误漏洞，该漏洞源于包含一个主机头注入漏洞。远程低权限攻击者可能会利用此漏洞触发重定向，从而导致敏感信息泄露。
Possible ATT&CK Techniques 3 AI
T1048.001 · Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1592.004 · Client Configurations T1557.002 · ARP Cache Poisoning
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-38485
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that leads to sensitive information leakage.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Vulnerability Title
Dell ECS 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Dell ECS是美国戴尔（Dell）公司的一款可扩展、易于管理且具有弹性的企业级对象存储解决方案。 Dell ECS 3.8.0版本之前存在输入验证错误漏洞，该漏洞源于包含一个主机头注入漏洞。远程低权限攻击者可能会利用此漏洞触发重定向，从而导致敏感信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-38485
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-38485
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-38485 (1)
Same Patch Batch · Dell · 2024-12-09 · 7 CVEs total
| CVE-2024-49600 | 7.8 HIGH | Dell Power Manager 访问控制错误漏洞 |
| CVE-2024-49602 | 6.5 MEDIUM | Dell PowerScale OneFS 安全漏洞 |
| CVE-2024-45761 | 5.4 MEDIUM | Dell OpenManage Server Administrator 输入验证错误漏洞 |
| CVE-2024-45760 | 4.3 MEDIUM | Dell OpenManage Server Administrator 安全漏洞 |
| CVE-2024-42426 | 4.3 MEDIUM | Dell PowerScale OneFS 资源管理错误漏洞 |
| CVE-2024-49603 | 4.3 MEDIUM | Dell PowerScale OneFS 安全漏洞 |
IV. Related Vulnerabilities
Same product: ECS
-
CVE-2026-26947
Dell ECS 3.8.1.x及ObjectScale 4.4.0前权限提升漏洞 -
CVE-2026-19613
ECS < 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure v -
CVE-2026-18807
ECS < 4.3.8 - Contributor+ Arbitrary Post Binding and Global -
CVE-2026-14230
ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater B -
CVE-2026-14229
ECS < 4.3.8 - Unauthenticated Private Content Disclosure via
Same weakness: CWE-601
-
CVE-2026-39600
WordPress Aculect AI Companion plugin <= 0.8.1 - Unvalidated -
CVE-2026-55252
OpenRun: Redirect URL validation bypass using //host paths -
CVE-2026-83589
Oauth-proxy: open redirect via /\ and /\t bypass in post-log -
CVE-2026-102090
Kiteworks Core content injection -
CVE-2026-103048
Open Redirect in Special:Book
V. Comments for CVE-2024-38485
No comments yet