PowerProtect Data Domainで認証情報漏えい、修正版あり
Summary
Dellのバックアップ用ストレージ PowerProtect Data Domainに、認証情報が外部に漏れる脆弱性が見つかり、全系統で修正版が出ています。Data Domainをバックアップ基盤に使っている組織が対象です。自社の版を確認し、該当すれば修正版への更新を計画に組み込んでください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
Dellのバックアップ用ストレージ PowerProtect Data Domainに、認証情報が外部に漏れる脆弱性が見つかり、全系統で修正版が出ています。Data Domainをバックアップ基盤に使っている組織が対象です。自社の版を確認し、該当すれば修正版への更新を計画に組み込んでください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Dell | PowerProtect Data Domain |
< 8.9.0.0 or later < 7.13.1.90 or later < 8.3.1.50 or later < 8.6.1.30 or later |
8.9.0.0 or later 7.13.1.90 or later 8.3.1.50 or later 8.6.1.30 or later |
Original description The description as published by the source.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to credential exposure. The credentials may be used to access the system with privileges of the compromised user.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web security_alert@emc.com
- web nvd.nist.gov
- web github.com