Openmanage Enterprise
CVE-2021-21584
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Dell OpenManage Enterprise version 3.5 and OpenManage Enterprise-Modular version 1.30.00 contain an information disclosure vulnerability. An authenticated low privileged attacker may potentially exploit this vulnerability leading to disclosure of the OIDC server credentials.
AnalysisAI
Dell OpenManage Enterprise version 3.5 and OpenManage Enterprise-Modular version 1.30.00 contain an information disclosure vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Technical ContextAI
This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. Dell OpenManage Enterprise version 3.5 and OpenManage Enterprise-Modular version 1.30.00 contain an information disclosure vulnerability. An authenticated low privileged attacker may potentially exploit this vulnerability leading to disclosure of the OIDC server credentials. Affected products include: Dell Openmanage Enterprise, Dell Openmanage Enterprise-Modular. Version information: version 3.5.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.
More in Openmanage Enterprise
View allDell OpenManage Enterprise versions prior to 3.6.1 contain an improper authentication vulnerability. Rated critical seve
OS command injection in Dell OpenManage Enterprise prior to version 4.7.0 enables low-privileged remote attackers to exe
SQL injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote attacker to ma
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a low-privileged authenticated remote attacker
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a remote attacker holding low-privilege creden
Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Control of Generation of Code ('Code In
Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. Rated high severity
Dell OpenManage Enterprise versions 3.4 through 3.6.1 and Dell OpenManage Enterprise Modular versions 1.20.00 through 1.
Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. Rated h
Remote OS command injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a high-privileged authen
Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. Rated high severity (CVSS 7.5), t
Privilege escalation in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote attacker already holding high
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today