Dell EMC Cloud Mobility for Dell Storage up to 1.3.0.x improper check for certificate revocation

Summaryinfo

A vulnerability identified as critical has been detected in Dell EMC Cloud Mobility for Dell Storage up to 1.3.0.x. This impacts an unknown function. Performing a manipulation results in improper check for certificate revocation. This vulnerability is reported as CVE-2023-23690. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in Dell EMC Cloud Mobility for Dell Storage up to 1.3.0.x (Cloud Software). This affects some unknown functionality. The manipulation with an unknown input leads to a improper check for certificate revocation vulnerability. CWE is classifying the issue as CWE-299. The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Cloud Mobility for Dell EMC Storage, versions 1.3.0.X and below contains an Improper Check for Certificate Revocation vulnerability. A threat actor does not need any specific privileges to potentially exploit this vulnerability. An attacker could perform a man-in-the-middle attack and eavesdrop on encrypted communications from Cloud Mobility to Cloud Storage devices. Exploitation could lead to the compromise of secret and sensitive information, cloud storage connection downtime, and the integrity of the connection to the Cloud devices.

The weakness was disclosed 01/19/2023 as dsa-2023-019. The advisory is shared at dell.com. This vulnerability is uniquely identified as CVE-2023-23690 since 01/17/2023. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 01/19/2023). MITRE ATT&CK project uses the attack technique T1557.003 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Cloud Software

Vendor

• Dell EMC

Name

• Cloud Mobility for Dell Storage

Version

• 1.3.0

License

• commercial

Website

• Vendor: https://www.dellemc.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion