Product:
PowerProtect Data Manager
Summary
Dell PowerProtect Data Manager for Hyper-V contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access. This issue affects versions 19.19 and 19.20 of the product.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-43888 |
Exploitation
To exploit this vulnerability, an attacker with local access can manipulate log files to insert sensitive information. This could allow the attacker to gain unauthorized access to sensitive data stored within the logs. The low privilege requirement makes it easier for potential attackers to exploit this vulnerability without needing elevated permissions.
Affected Products
- PowerProtect Data Manager 19.19: Affected by the log file vulnerability allowing unauthorized access.
- PowerProtect Data Manager 19.20: Similar vulnerability present, enabling potential exploitation by low privileged attackers.
Mitigation
To mitigate this vulnerability, users should apply the latest security updates provided by Dell. Regularly monitoring and auditing log files for sensitive information can also help reduce the risk of exploitation. It is recommended to limit local access to the system to trusted personnel only.